CVE-2026-55170
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In OpenFGA prior to version 1.18.0, when MySQL is used as the datastore, the tuple, changelog, and authorization_model identifier columns compare case-distinct values (e.g., user:Alice and user:alice) as equivalent, causing two distinct check requests to return the same response.
Risk Assessment
The organization may incorrectly grant or deny access when usernames differ only in case, leading to authorization policy violations and potential data leakage.
Recommendation
Upgrade OpenFGA to version 1.18.0 or later immediately, which fixes the case-insensitive comparison issue.
Other vulnerabilities in OpenFGA
See all- CVE-2026-55689Medium
In OpenFGA prior to version 1.18.0, the OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set. This allows a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA.
- CVE-2026-48096Medium
OpenFGA, an authorization engine, prior to version 1.16.0, had an issue with iterator caching where two distinct check requests could produce the same cache key. This led to the reuse of an earlier cached result for a subsequent request.
- CVE-2026-40293Medium
In OpenFGA versions 0.1.4 through 1.13.1, when configured with preshared-key authentication and the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default and does not require authentication, potentially leading to sensitive data exposure.
- CVE-2026-34972Medium
OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.
- CVE-2023-35933Medium
OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected if they are using these versions and executing these calls on vulnerable models.
Original NVD description (English source)
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.