CVE-2026-48096
mediumpriority · track · 21OT risk · elevatedEPSS 0.001 · 1 %ileEUUSEPSS · scored 2026-10-27
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-8396-jffm-qx4wOpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning2026-06-11ghsa · osvUS
### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. ### Preconditions This applies if the following preconditions are present: - FGA runs with SharedIteratorCache enabled, - FGA runs with ListObjectsIteratorCache enabled. ### Fix Upgrade to version 1.16.0 or greater. ### Acknowledgements OpenFGA would like to thank @j4xT for the discovery and the detailed report.
- GO-2026-5239OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga2026-06-25vendor · osvUS
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2026-48096cnnvd
- https://openfga.dev/Patchcnnvd
- https://github.com/openfga/openfga/releases/tag/v1.16.0enisa_euvd
- https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4wenisa_euvd
- https://github.com/openfga/openfga/releases/tag/v1.16.0ProductRelease Notesnvd
- https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4wVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan