CVE-2024-8260 OPA SMB Force-Authentication

What is CVE-2024-8260?

CVE-2024-8260 is a medium-severity authentication bypass vulnerability in Styra OPA, published on 30 Aug 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Weakness: CWE-294

Which versions are affected by CVE-2024-8260?

3 open source packages ship an affected version, including github.com/open-policy-agent/opa. It affects 1 product.

Products include Openpolicyagent Open Policy Agent.

How do I fix CVE-2024-8260?

Upgrade github.com/open-policy-agent/opa to 0.68.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-8260 being exploited?

There is no known exploitation of CVE-2024-8260 in the wild and no public exploit code.

Other vulnerabilities in Styra OPA

• CVE-2022-33082 Denial of service in Open Policy Agent High 7.5
• CVE-2022-28946 Out of bounds memory access in github.com/open-policy-agent/opa High 7.5
• CVE-2022-36085 OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions High 7.4
• CVE-2022-23628 Array literal misordering in github.com/open-policy-agent/opa Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-GJ96630, GHSA-c77r-fh37-x2px, GO-2024-3141, MINI-8rcp-2726-m5mq, MINI-c7hp-jr2w-q49w, MINI-pxcv-5x66-p446 and 1 more.