Open Policy Injection occurs when untrusted data is used as input in policy evaluations or rules within tools like Open Policy Agent (OPA) or Rego. An attacker can manipulate these inputs to inject malicious policies, bypass access controls, or expose sensitive information. This vulnerability arises when there is insufficient validation of the data used in policy logic, leading to potential information disclosure, privilege escalation, or other security breaches.

Remediation

• Avoid allowing policies to be dynamically loaded or modified at runtime from untrusted sources.
• Ensure all inputs to OPA policies or Rego rules are strictly validated against expected schemas and formats before being processed.
• Apply sanitisation techniques to clean user inputs before including them in policy evaluations.