CVE-2025-46569

What it actually does

Crafted HTTP request paths to the Data API allow injection of arbitrary Rego code into dynamically constructed policy evaluation queries, enabling manipulation of query success/failure outcomes, oracle-style attacks, erroneous authorization decisions, or computationally expensive payloads that trigger denial of service.

Why it matters to the business

Organizations using OPA for authorization decisions face risks of policy bypass, incorrect access grants, or service outages; the widespread use of OPA in cloud-native and microservices environments amplifies potential blast radius if unpatched.

How an attack unfolds

An attacker with network access to the OPA Data API sends an HTTP request whose path is specially constructed to inject Rego code into the internal query; this injected code can force the evaluation to succeed or fail on demand, leak decision information via side channels, or consume excessive resources leading to DoS.

How to fix it

Upgrade Open Policy Agent to version 1.4.0 or later, which incorporates commit 8b0720247e65b97fe7715ca15682fee4040df4d1. As a temporary mitigation, restrict network access to OPA's REST APIs to localhost or trusted networks only.

How to confirm the fix worked

Verify OPA version is 1.4.0 or newer via the /v1/data or version endpoint; attempt previously successful injection paths to confirm they no longer alter evaluation results or cause excessive CPU usage.

Typical attack path

1. Identify reachable OPA Data API endpoint
2. Craft HTTP request path containing Rego injection payload
3. Submit request to trigger policy evaluation
4. Observe result to confirm success/failure manipulation or resource exhaustion

How to detect it

Inspect OPA server logs for unusually long or malformed paths in Data API requests; monitor for spikes in CPU or evaluation latency correlated with specific client IPs or request patterns.

What your security team should do

• Immediately upgrade all OPA instances to 1.4.0 or the commit 8b0720247e65b97fe7715ca15682fee4040df4d1
• Apply network segmentation or firewall rules to limit Data API exposure
• Review and harden Rego policies to minimize impact of evaluation manipulation
• Enable detailed request logging for OPA Data API paths