CVE-2024-40627 json
OpaMiddleware does not filter HTTP OPTIONS requests
published 2024-07-15 2 y ago modified 2026-09-10 1 mo ago also GHSA-5f5c-8rvc-j8wf , PYSEC-2026-1361 , EUVD-2024-2263
- cvss
- 5.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack authentication, and are passed through directly to the application. `OpaMiddleware` allows all HTTP `OPTIONS` requests without evaluating it against any policy. If an application provides different responses to HTTP `OPTIONS` requests based on an entity existing (such as to indicate whether an entity is writable on a system level), an unauthenticated attacker could discover which entities exist within an application. This issue has been addressed in release version 2.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Patch / fix
- pypi fastapi-opa 2.0.1
- busykoala fastapi-opa 2.0.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| OSV | 3.1 | 5.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | fastapi-opa | <2.0.1 |
2.0.1 |
Affected products
- busykoala fastapi-opa
Classification
- Weakness
-
- CWE-204 Observable Response Discrepancy
References
-
github.com
/busykoala/fastapi-opa/commit/9588109ff651f7ffc92687129c4956126443fb8c
web
-
github.com
/busykoala/fastapi-opa/commit/9458845a6f6f414c0b79587fae83d7f14d74dfb4
web
-
github.com
/busykoala/fastapi-opa/security/advisories/GHSA-5f5c-8rvc-j8wf
web
-
github.com
/busykoala/fastapi-opa/blob/6dd6f8c87e908fe080784a74707f016f1422b58a/fastapi_opa/opa/opa_middleware.py#L79-L80
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-40627
advisory
-
github.com
/busykoala/fastapi-opa
package
-
pypi.org
/project/fastapi-opa
package
-
github.com
/advisories/GHSA-5f5c-8rvc-j8wf
advisory
Sources
- CVE List CVE-2024-40627
- GitHub Advisory GHSA-5f5c-8rvc-j8wf
- NVD CVE-2024-40627
- OSV PYSEC-2026-1361
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.