CVE-2026-48096
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
OpenFGA, an authorization engine, prior to version 1.16.0, had an issue with iterator caching where two distinct check requests could produce the same cache key. This led to the reuse of an earlier cached result for a subsequent request.
Risk Assessment
Organizations may be exposed to unauthorized access as results from earlier requests could be improperly used in new contexts.
Recommendation
It is recommended to upgrade OpenFGA to version 1.16.0 or later to mitigate this vulnerability.
Other vulnerabilities in OpenFGA
See all- CVE-2026-55689Medium
In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.
- CVE-2026-55170Medium
In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.
- CVE-2026-40293Medium
In OpenFGA versions 0.1.4 through 1.13.1, when configured with preshared-key authentication and the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default and does not require authentication, potentially leading to sensitive data exposure.
- CVE-2026-34972Medium
OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.
- CVE-2023-35933Medium
OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected if they are using these versions and executing these calls on vulnerable models.
Original NVD description (English source)
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.