CVE-2022-36085

Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the policy compilation stage. A bypass of this protection has been found, where the use of the `with` keyword to mock such a built-in function (a feature introduced in OPA v0.40.0), isn’t taken into account by `WithUnsafeBuiltins`. Multiple conditions need to be met in order to create an adverse effect. Version 0.43.1 contains a patch for this issue. As a workaround, avoid using the `WithUnsafeBuiltins` function and use the `capabilities` feature instead.

• CWE-20
• CWE-693

• https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/pull/4540Exploit, Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/pull/4616Exploit, Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/releases/tag/v0.43.1Third Party Advisory
• https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjrExploit, Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/commit/25a597bc3f4985162e7f65f9c36599f4f8f55823Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/commit/3e8c754ed007b22393cf65e48751ad9f6457fee8Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/pull/4540Exploit, Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/pull/4616Exploit, Patch, Third Party Advisory
• https://github.com/open-policy-agent/opa/releases/tag/v0.43.1Third Party Advisory
• https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjrExploit, Patch, Third Party Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3608Cross-site Scripting (XSS) - Stored in GitHub repository tho…8.4
• CVE-2022-36080Wikmd is a file based wiki that uses markdown. Prior to vers…6.1
• CVE-2022-36081Wikmd is a file based wiki that uses markdown. Prior to vers…7.5
• CVE-2022-36082mangadex-downloader is a command-line tool to download manga…5.3
• CVE-2022-36083JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, J…5.3
• CVE-2022-36084cruddl is software for creating a GraphQL API for a database…8.8
• CVE-2022-36086linked_list_allocator is an allocator usable for no_std syst…9.8
• CVE-2022-36087OAuthLib is an implementation of the OAuth request-signing l…6.5
• CVE-2022-36088GoCD is a continuous delivery server. Windows installations …5.5
• CVE-2022-36089KubeVela is an application delivery platform Users using Kub…9.8
• CVE-2022-3609The GetYourGuide Ticketing WordPress plugin before 1.0.4 doe…4.8
• CVE-2022-36090XWiki Platform Old Core is a core package for XWiki Platform…8.1