v1.22.2
2026-11-06T08:52:13Z•b2c0f6ed2e83d221361c1cdf0b5838d1c524161efb454724d594a30c3ad7d152
GHSA-g2pf-6v5v-qcc8OPAOpen Policy Agentauthorizationbundle signature verificationcompiler regressionparser regressionpolicy enginepolicy evaluationsecurity advisorysignature bypasssupply chain security
What happened
Open Policy Agent (OPA) releases v1.21.3 and v1.22.x include security and correctness fixes. Most notably, v1.21.3 fixes a bundle signature verification bypass that could allow attackers controlling a bundle source, network path, or local bundle storage to supply arbitrary policy and data despite signature verification being enabled. Other releases address authorization input normalization, compiler and parser regressions, rule indexing, and type-checking behavior.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- b2c0f6ed2e83d221361c1cdf0b5838d1c524161efb454724d594a30c3ad7d152
- Enrichment time
- 2026-11-06T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.