CVSS 3.1
7.3 highCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HCVE-2024-8260
High (7.3) in openpolicyagent open policy agent. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/open-policy-agent/opa 0.68.0.
A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-294
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openpolicyagent:open_policy_agent
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c77r-fh37-x2px | Go | github.com/open-policy-agent/opa | <0.68.0 | 0.68.0 |
| GO-2024-3141 | Go | github.com/open-policy-agent/opa | <0.68.0 | 0.68.0 |