OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response
### Description When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. ### Am I Affected? You are affected if you meet each of the following preconditions: * You are running OpenFGA with --authn-method preshared, and * The playground is enabled, and * The playground endpoint is accessible beyond localhost or trusted networks. ### Fix Upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-40293US | — | — | ||
OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan