RATATOSKRATATOSK
Sign in

Open Policy Agent (OPA)

v1.21.3Security
Oct 19, 2026

ACTION 1CHECK 1OTHER 3

A security maintenance release fixes two bundle-signature bypasses and tightens verification configuration behavior. It also adds a narrowly scoped opt-out for unsigned delta bundles.

Action needed (1)

  • securityBundle signature verification bypass, fixed

    OPA fixes a bundle signature verification bypass associated with GHSA-g2pf-6v5v-qcc8.

Check if affected (1)

  • securitySigning block controls bundle verification

    Applies if you configure either bundles[_].signing or discovery.signing.

    Verification now depends on the presence of a signing block in bundles[_].signing or discovery.signing; keyid only selects which key to use. This corrects the behavior covered by GHSA-g2pf-6v5v-qcc8.

All 3 other recorded changesadditions 2 · value changes 1

additions (2)

  • or the new (*VerificationConfig).WithOptionalSignature().
  • can opt out per bundle with the new bundles[_].signing.allow_unsigned_delta_bundles (or discovery.signing.allow_unsigned_delta_bundles) field.

value changes (1)

  • OPA now logs a warning at startup for bundles in this state.
Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Open Policy Agent (OPA) releases →