68 matches found
cupcake
Cupcake AIエージェントにルールを守らせる。 AIエージェントのポリシー実施 レイヤー。モデルコンテキストを消費せずに、パフォーマンスとセキュリティを向上させます。 決定論的なルール順守 をエージェントに実現。インタラクティブな例 ルールをコンテキストからポリシー・アズ・コードに移すことでパフォーマンス向上 。 アラートをトリガー し、ルールに繰り返し違反する悪質なエージェントをタイムアウトにします。 Cupcakeはエージェントイベントをインターセプトし、Open Policy Agent OPA...
conftest
Conftest Conftestは、構造化された設定データに対するテストを書くのに役立ちます。Conftestを使うと、Kubernetes設定、Tektonパイプライン定義、Terraformコード、Serverless設定、その他のあらゆる設定ファイルに対するテストを書くことができます。 Conftestは、アサーションを記述するためにOpen Policy AgentのRego言語を使用します。Regoの詳細については、Open Policy AgentドキュメントのPolicy Languageセクションを参照してください。...
opa
Open Policy Agent Open Policy Agent OPA は、スタック全体で統一された、コンテキストを考慮したポリシー適用を可能にする、オープンソースの汎用ポリシーエンジンです。 OPA は、Cloud Native Computing Foundation CNCF ランドスケープにおいて graduated プロジェクトであることを誇りに思っています。詳細については、CNCF の発表をお読みください。 OPA を使い始める Rego Playground で最初の Rego...
reposaur
Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...
GO-2026-4506 vulnerabilities
Vulnerabilities for packages: opa-envoy...
Contras Affected by CopyFile Policy Subversion via Symlinks
Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...
GHSA-RH99-WC69-C255 Contras Affected by CopyFile Policy Subversion via Symlinks
Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...
Azure Linux 3.0 Security Update: opa (CVE-2025-46569)
The version of opa installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-46569 advisory. - Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a...
CVE-2023-45822
Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when...
CVE-2022-23628
OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths...
GO-2025-4147 Minder does not sandbox http.send in Rego programs in github.com/mindersec/minder
Minder does not sandbox http.send in Rego programs in github.com/mindersec/minder...
CVE-2025-65109 Minder does not sandbox http.send in Rego programs
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...
CVE-2025-65109 Minder does not sandbox http.send in Rego programs
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...
CVE-2025-65109
Summary (CVE-2025-65109) Minder exposes a risk where the Minder server can fetch content (potentially including restricted URLs) due to insufficient sandboxing of http.send in Rego policy evaluation. Affected: Minder Helm v0.20241106.3386+ref.2507dbf and Minder Go v0.0.72–0.0.83. Impact: access t...
CVE-2025-65109 Minder does not sandbox http.send in Rego programs
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...
Inclusion of Web Functionality from an Untrusted Source
Overview github.com/mindersec/minder/internal/datasources/rest is an implementation of a REST data source Affected versions of this package are vulnerable to Inclusion of Web Functionality from an Untrusted Source via the http.send function in Rego programs. A user can access internal network...
GHSA-6XVF-4VH9-MW47 Minder does not sandbox http.send in Rego programs
Impact Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to for example, if the Minder server is behind a firewall or other network partition. Patches...
EUVD-2025-198365
Minder does not sandbox http.send in Rego programs...
Minder does not sandbox http.send in Rego programs
Impact Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to for example, if the Minder server is behind a firewall or other network partition. Patches...