CVE-2024-8260

MEDIUM6.1EPSS 0.14%

OPA for Windows has an SMB force-authentication vulnerability

Published: 8/30/2024Modified: 2/4/2026

Also known as:GHSA-c77r-fh37-x2pxCGA-h3gj-f857-hxr4GO-2024-3141

Description

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Affected packages (2)

Go/github.com/open-policy-agent/opafrom 0, < 0.68.0
Go/github.com/open-policy-agent/opafrom 0, < 0.68.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-8260
PATCHhttps://github.com/open-policy-agent/opa
WEBhttps://github.com/open-policy-agent/opa/commit/10f4d553e6bb6ae9c69611ecdd9a77dda857070e
WEBhttps://github.com/open-policy-agent/opa/releases/tag/v0.68.0
WEBhttps://pkg.go.dev/vuln/GO-2024-3141
WEBhttps://www.tenable.com/security/research/tra-2024-36