CVE-2024-8260: Openpolicyagent Open Policy Agent

High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Affected products

• Openpolicyagent Open Policy Agent: before 0.68.0 (fixed in 0.68.0)

Published 2024-08-30. Last modified 2026-06-17.