Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M
CVE-2026-48096OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
Medium 5.0
In plain English
A medium-severity insufficient verification of data authenticity in openfga from openfga. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/openfga/openfga | 1.16.0 | GHSA-8396-jffm-qx4w |
| Go | github.com/openfga/openfga | 1.16.0 | GO-2026-5239 |
Affected products (as reported)
Weakness: CWE-345, CWE-668 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w x_refsource_CONFIRM
- https://github.com/openfga/openfga/releases/tag/v1.16.0 x_refsource_MISC