conftest

Conftest Conftest는 구조화된 구성 데이터에 대한 테스트를 작성할 수 있도록 도와줍니다. Conftest를 사용하면 Kubernetes 구성, Tekton 파이프라인 정의, Terraform 코드, Serverless 구성 또는 기타 다른 구성 파일에 대한 테스트를 작성할 수 있습니다. Conftest는 어서션assertion을 작성하기 위해 Open Policy Agent의 Rego 언어를 사용합니다. Rego에 대한 자세한 내용은 Open Policy Agent 문서의 Policy Language 섹션에서 확인...

cupcake

Cupcake AI 에이전트가 규칙을 따르게 하세요. AI 에이전트를 위한 정책 적용Policy enforcement 계층으로, 모델 컨텍스트를 소모하지 않으면서 더 나은 성능과 보안을 제공합니다. 에이전트를 위한 결정적 규칙 준수. 대화형 예제 규칙을 컨텍스트 밖으로 옮기고 정책-코드policy-as-code로 전환하여 더 나은 성능 을 제공합니다. 경고 트리거 및 규칙을 반복적으로 위반하는 잘못된 에이전트를 타임아웃 처리합니다. Cupcake는 에이전트 이벤트를 가로채서 사용자 정의 규칙 을 기준으로 평가하며, 이 규칙은...

opa

Open Policy Agent Open Policy Agent OPA는 전체 스택에 걸쳐 통합된 상황 인식형 정책 적용을 가능하게 하는 오픈 소스 범용 정책 엔진입니다. OPA는 Cloud Native Computing Foundation CNCF 랜드스케이프에서 졸업graduated 프로젝트가 된 것을 자랑스럽게 생각합니다. 자세한 내용은 CNCF 발표를 읽어보세요. OPA 시작하기 Rego Playground에서 첫 번째 Rego 정책을 작성하거나, 피드백과 지원을 위해 작업을 공유하는 데 사용하세요. 어디서부터 시작해야...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

EUVD-2026-78059

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

CVE-2026-65838

Skipper , an HTTP router and reverse proxy, has a bypass in its OPA authorization filter prior to version 0.27.35 . The opaAuthorizeRequestWithBody filter uses ExtractHttpBodyOptionally, which leaves OPA with an empty parsed_body when an oversized Content-Length request exceeds the -open-policy-a...

conftest v0.70.0

Conftest Conftest helps you write tests against structured configuration data. Using Conftest you can write tests for your Kubernetes configuration, Tekton pipeline definitions, Terraform code, Serverless configs or any other config files. Conftest uses the Rego language from Open Policy Agent fo...

opa v1.20.2

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

GHSA-RH99-WC69-C255 Contras Affected by CopyFile Policy Subversion via Symlinks

Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...

Contras Affected by CopyFile Policy Subversion via Symlinks

Impact The Kata agent policies generated by the Contrast CLI had an issue in the CopyFile verification, which allowed arbitrary writes to the guest root filesytem. A malicious process on the host with the capability to connect to the Kata agent VSOCK could connect to the agent and issue a series ...

Azure Linux 3.0 Security Update: opa (CVE-2025-46569)

The version of opa installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-46569 advisory. - Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a...

CVE-2023-45822

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when...

CVE-2022-23628

OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree AST that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths...

GO-2025-4147 Minder does not sandbox http.send in Rego programs in github.com/mindersec/minder

Minder does not sandbox http.send in Rego programs in github.com/mindersec/minder...

CVE-2025-65109 Minder does not sandbox http.send in Rego programs

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

CVE-2025-65109 Minder does not sandbox http.send in Rego programs

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have acce...

CVE-2025-65109

Summary (CVE-2025-65109) Minder exposes a risk where the Minder server can fetch content (potentially including restricted URLs) due to insufficient sandboxing of http.send in Rego policy evaluation. Affected: Minder Helm v0.20241106.3386+ref.2507dbf and Minder Go v0.0.72–0.0.83. Impact: access t...