Log in Start free

Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-55170OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

Low 2.1

In plain English

A low-severity security flaw in openfga from openfga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.3%top 72.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/openfga/openfga1.18.0GHSA-cf98-j28v-49v6
Gogithub.com/openfga/openfga1.18.0GO-2026-5322

Affected products (as reported)

VendorProductVersions
openfga openfga < 1.18.0

Weakness: CWE-178 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References