| OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userCVE-2026-61709 · GHSA-G3PG-FRFM-PR2MVersion ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA Improper Policy EnforcementCVE-2026-55170 · GHSA-CF98-J28V-49V6Version ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoningCVE-2026-48096 · GHSA-8396-JFFM-QX4WVersion ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetCVE-2026-55689 · GHSA-HCXC-WF8J-23HVVersion ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionCVE-2026-34972 · GHSA-JWVJ-G8PC-CX45Version ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML responseCVE-2026-40293 · GHSA-68M9-983M-F3V5Version ranges need review. |
github.com/openfga/openfgaRed Hat Ceph Storage 6/rhceph/rhceph-6-dashboard-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA has Improper Policy EnforcementCVE-2026-41131 · GHSA-57J5-QWP2-VQP6Version ranges need review. |
github.com/openfga/openfgaMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA has an Authorization Bypass through cached keysCVE-2026-33729 · GHSA-H6C8-CWW8-35HFVersion ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Improper Policy EnforcementCVE-2026-24851 · GHSA-JQ9F-GM9W-RWM9Version ranges need review. |
github.com/openfga/openfgaRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA Improper Policy EnforcementCVE-2025-64751 · GHSA-2C64-VMV2-HGFCVersion ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2025-48371 · GHSA-C72G-53HW-82Q7Version ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2024-56323 · GHSA-32Q6-RR98-CJQVVersion ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2024-31452 · GHSA-8CPH-M685-6V6RVersion ranges need review. |
github.com/openfga/openfga |
Go |
High
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2025-25196 · GHSA-G4V5-6F5P-M38JVersion ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA denial of serviceCVE-2024-23820 · GHSA-RXPW-85VW-FX87Version ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Vulnerable to DoS from circular relationship definitionsCVE-2023-43645 · GHSA-2HM9-H873-PGQHVersion ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2025-46331 · GHSA-W222-M46C-MGH6Version ranges need review. |
github.com/openfga/openfga |
Go |
Medium
|
Fix reported |
|
| OpenFGA Authorization Bypass CVE-2025-55213 · GHSA-MGH9-4MWP-FG55Version ranges need review. |
github.com/openfga/openfgaRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| OpenFGA Authorization BypassCVE-2024-42473 · GHSA-3F6G-M4HR-59H8Version ranges need review. |
github.com/openfga/openfga |
Go |
High
|
Fix reported |
|
| OpenFGA DoS vulnerabilityCVE-2023-45810 · GHSA-HR4F-6JH8-F2VQVersion ranges need review. |
github.com/openfga/openfga |
Go |
High
|
Fix reported |
|
