Popular: Data updated October 27, 2026

Categories

Internet1,356
Communication321
Audio & video898
Graphics & design539
Office & productivity1,124
Developer tools3,134
AI tools529
Security & privacy385
System tools3,114
Games523
Education & science239
Network & IT284

openapi-oathkeeper: all versions and old releases

Generate Ory Oathkeeper access rules from an OpenAPI 3 contract.

4 versions of openapi-oathkeeper are listed here, from March 19, 2026 to the current 0.8.0. Each one links to the publisher’s own installer files.

2026: 4 4 26
VersionDateSizeFiles
0.8.0Latest September 9, 2026 — 64-bit ZIP32-bit ZIP
Release notes
## What's Changed

• Add integration tests by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/143
• feat:update dependencies and image version by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/144
• Capture array and object path params as explicit types by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/145

**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.19...v0.8.0
0.7.19 September 7, 2026 — 64-bit ZIP32-bit ZIP
Release notes
## Security fix

**High severity:** Overbroad path-parameter regex in generated Ory Oathkeeper access rules could cause an authentication/authorization bypass.

Previously, every OpenAPI `string` path parameter (and any parameter type the generator couldn't classify) was compiled to the unanchored regex token `<.+>`. Because `.` matches `/` in Go's regexp engine — and in Ory Oathkeeper's `regexp` matching strategy — a rule generated for a single path segment (e.g. `/public/{slug}`) also matched deeper, unrelated paths under the same prefix (e.g. `/public/admin/delete-all-users`). If those deeper paths weren't defined as their own, more specific OpenAPI operations, the broader (often unauthenticated `noop`) rule would match and proxy them instead of being rejected.

Generated rules for `string` and unclassified path parameters now use `<[^/]+>`, anchored to a single URL segment, matching the behavior already documented for numeric parameters.

**Action required:** Regenerate your Ory Oathkeeper access rules with this version and redeploy them. Rules generated by earlier versions using `string` path parameters may be broader than intended.

See [GHSA-9f3w-vm54-7gfc](https://github.com/cerberauth/openapi-oathkeeper/security/advisories/GHSA-9f3w-vm54-7gfc) for full details. Thanks to @EQSTLab for the responsible disclosure.

## What's Changed

• fix(generator):anchor string path-parameter regex to a single URL segment by @emmanuelgautier in https://github.com/cerberauth/openapi-oathkeeper/pull/142

**Full Changelog**:https://github.com/cerberauth/openapi-oathkeeper/compare/v0.7.18...v0.7.19
0.7.18 August 13, 2026 — 64-bit ZIP32-bit ZIP
0.7.15 March 19, 2026 — 64-bit ZIP32-bit ZIP

Most popular in Languages & SDKs

See all
  1. Go Programming LanguageAn open source programming language that makes it simple to build secure, scalable systems.
  2. LLVMA collection of modular and reusable compiler and toolchain technologies.
  3. DenoA modern runtime for JavaScript and TypeScript
  4. CMakeCMake is a cross-platform, open-source build system generator.
  5. YarnYarn is a package manager that doubles down as project manager. Whether you work on one-shot projects or large monorepos, as a hobbyist or an enterprise user, we've got you covered.
  6. CcacheCcache is a compiler cache. It speeds up recompilation by caching previous compilations and detecting when the same compilation is being done again.
  7. sbtA build tool for Scala, Java, and more
  8. BOINCOpen-source software for volunteer computing and grid computing.
  9. Dart SDKA set of tools and libraries for the Dart programming language.
  10. NVM for WindowsA node.js version management utility for Windows. Ironically written in Go.

More from CerberAuth

See all
  • jwtopJWT operations CLI - decode, verify, create, sign, and exploit JWTs.

Share