What’s Vulnerable › Vulnerabilities

CVE-2026-48096: OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-06-17
• Weakness: CWE-345

Description

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

Affected products

• openfga Helm Charts: before 0.3.5 — fixed in 0.3.5
• openfga: before 1.16.0 — fixed in 1.16.0

How to fix

Upgrade to a fixed version: openfga Helm Charts 0.3.5; openfga 1.16.0. Check the vendor advisory for mitigations.

References

• https://github.com/openfga/openfga/releases/tag/v1.16.0
• https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w

Get alerted when CVE-2026-48096 or the next vulnerability affects your stack