OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.
{ "imports": [ { "path": "github.com/open-policy-agent/opa/loader", "symbols": [ "All", "AllRegos", "AsBundle", "Filtered", "FilteredPaths", "FilteredPathsFS", "GetBundleDirectoryLoader", "GetBundleDirectoryLoaderFS", "GetBundleDirectoryLoaderWithFilter", "allRec", "fileLoader.All", "fileLoader.AsBundle", "fileLoader.Filtered" ], "goos": [ "windows" ] } ] }