CVE-2025-46569

Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.

• CWE-94
• CWE-863

• https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c
• https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7

Published

May 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-4656Vault Community and Vault Enterprise rekey and recovery key …3.1
• CVE-2025-46560vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2025-46565Vite is a frontend tooling framework for javascript. Prior t…5.3
• CVE-2025-46566DataEase is an open-source BI tool alternative to Tableau. P…9.8
• CVE-2025-46567LLama Factory enables fine-tuning of large language models. …7.8
• CVE-2025-46568Stirling-PDF is a locally hosted web application that allows…7.5
• CVE-2025-4657A buffer overflow vulnerability was reported in the Lenovo P…8.4
• CVE-2025-46570vLLM is an inference and serving engine for large language m…2.6
• CVE-2025-46571Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2025-46572passport-wsfed-saml2 provides passport strategy for both WS-…9.3
• CVE-2025-46573passport-wsfed-saml2 provides passport strategy for both WS-…8.6
• CVE-2025-46574There is an information disclosure vulnerability in the Gold…5.3