OPA SMB Force-Authentication

6.1 CVSS

Vulnerability Description

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8260

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.tenable.com/security/research/tra-2024-36

Affected Vendor

Styra

View all reports →

Affected Software

OPA

Vulnerable Versions:

Timeline

Official Publish: August 30th, 2024

Last Modified: August 30th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.