# Open Policy Agent (OPA) v1.21.3

> Security · 2026-10-19

A security maintenance release fixes two bundle-signature bypasses and tightens verification configuration behavior. It also adds a narrowly scoped opt-out for unsigned delta bundles.

## Action needed
- **[security]** Bundle signature verification bypass, fixed
  - OPA fixes a bundle signature verification bypass associated with `GHSA-g2pf-6v5v-qcc8`.

## Check if affected
- **[security]** Signing block controls bundle verification
  - Applies if you configure either `bundles[_].signing` or `discovery.signing`.
  - Verification now depends on the presence of a `signing` block in `bundles[_].signing` or `discovery.signing`; `keyid` only selects which key to use. This corrects the behavior covered by `GHSA-g2pf-6v5v-qcc8`.

## Other recorded changes
- 3 (added 2, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/opa/v1.21.3)

[Original release notes](https://github.com/open-policy-agent/opa/releases/tag/v1.21.3)