CVE-2024-8260

OPA SMB Force-Authentication

6.1 MediumFix available

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

0.34%Up 0.3 points since Aug 31, 2024

What each source reports

CVE List Score used 6.1

OPA SMB Force-Authentication

Record: CVE-2024-8260
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weakness: CWE-294
Updated: 2026-11-02

EUVDEUVD-2024-2556 6.1

Record: EUVD-2024-2556
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c77r-fh37-x2px 5.2

OPA for Windows has an SMB force-authentication vulnerability

Record: GHSA-c77r-fh37-x2px
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weakness: CWE-294
Updated: 2026-11-02

NVD 6.1

Record: CVE-2024-8260
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-294
Updated: 2026-11-02

OSV 6.1

OPA SMB Force-Authentication

Record: CVE-2024-8260
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weakness: CWE-294
Updated: 2026-11-02

OSVGHSA-c77r-fh37-x2px 5.2

OPA for Windows has an SMB force-authentication vulnerability

Record: GHSA-c77r-fh37-x2px
CVSS 4.0: 5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Weakness: CWE-294
Updated: 2026-11-02

OSVGO-2024-3141 No score

OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa

OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Record: GO-2024-3141
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/open-policy-agent/opa` Go	before 0.68.0	0.68.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-8260 is a medium vulnerability (CVSS 6.1) in Open-policy-agent Opa, published August 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in github.com/open-policy-agent/opa 0.68.0.