CVE-2024-8260

CVE-2024-8260 is a high-severity SMB force-authentication vulnerability affecting all versions of Open Policy Agent (OPA) for Windows prior to v0.68.0. This flaw stems from improper input validation, allowing a malicious actor to supply an arbitrary SMB share instead of a legitimate Rego file to OPA CLI or library functions. The CVSS score of 7.3 indicates a high impact on confidentiality, integrity, and availability, requiring local access and user interaction for exploitation. While the vulnerability has a low EPSS score and is not listed in CISA's KEV catalog, suggesting no active widespread exploitation, there is no public exploit code available, and community discussion and media coverage are minimal.