v1.22.3
2026-11-11T08:52:13Z•8008e9a8b89e785f2ccdf46593acb6b1f1a4b5fda32b06a1dbcc0bf547087c57
GHSA-fpmh-frq8-7rj8GHSA-g2pf-6v5v-qcc8OPAOpen Policy AgentRegobundle signature verificationcompiler regressiondependency updateklauspost/compresspolicy enginesignature bypasssupply chain securitytype checker
What happened
Open Policy Agent (OPA) releases v1.21.3–v1.22.3 include bug fixes, dependency updates, and security-related corrections. OPA v1.21.3 fixes a bundle signature verification bypass that could allow attackers able to modify bundle bytes to supply arbitrary policy and data. v1.22.3 updates klauspost/compress in response to GHSA-fpmh-frq8-7rj8, although OPA does not support the affected zstd handlers. Other releases address compiler, type-checker, rule-indexer, parsing, authorization input, and build-toolchain issues.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- 8008e9a8b89e785f2ccdf46593acb6b1f1a4b5fda32b06a1dbcc0bf547087c57
- Enrichment time
- 2026-11-11T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.