v1.21.3
2026-10-20T08:52:14Z•aaf12587d7efbeb74c082544b6686a5d815c763102289e247228c087046fc35d
Go dependenciesOPAOpen Policy Agentauthorizationbundle signature bypassman-in-the-middlepolicy integritysecurity updatesignature verificationsupply chain security
What happened
Open Policy Agent releases include a high-impact bundle signature verification bypass fixed in v1.21.3. Attackers who can modify bundle bytes, control the bundle/discovery service or artifact store, perform a man-in-the-middle attack, or write to local bundle paths could cause OPA to accept arbitrary policy and data despite signature verification being configured. The release also includes dependency and Go standard-library security updates, including issues referenced by Go vulnerability IDs, plus an authorization-input consistency fix.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- aaf12587d7efbeb74c082544b6686a5d815c763102289e247228c087046fc35d
- Enrichment time
- 2026-10-20T08:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.