GHSA-c77r-fh37-x2pxMediumCVSS 6.1

OPA for Windows has an SMB force-authentication vulnerability

Published
August 30, 2024
Last Modified
September 20, 2024

🔗 CVE IDs covered (1)

CVE-2024-8260 →

📋 Description

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

🎯 Affected products1

  • go/github.com/open-policy-agent/opa:< 0.68.0

🔗 References (6)