← All advisories

Low severityNVD Advisory· Published Jun 18, 2026· Updated Jun 18, 2026

OpenFGA Improper Policy Enforcement

CVE-2026-55170

Description

Description

In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.

Preconditions

This applies if the following preconditions are met:

You run OpenFGA with MySQL as the datastore
Your authorization decisions rely on case-sensitive user strings.

Fix

Upgrade to OpenFGA 1.18.0 or greater.

Acknowledgements

OpenFGA would like to thank @sahajamoth for the detailed report.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/openfga/openfgaGo	< 1.18.0	1.18.0

Affected products

13

Openfga/Openfgallm-fuzzy
Range: <1.18.0
osv-coords12 versions
pkg:apk/chainguard/commercial-grafana-12.4 pkg:apk/chainguard/commercial-grafana-13.0 pkg:apk/chainguard/commercial-grafana-13.1 pkg:apk/chainguard/grafana-12.3 pkg:apk/chainguard/grafana-12.4 pkg:apk/chainguard/grafana-13.0 pkg:apk/chainguard/grafana-fips-12.3 pkg:apk/chainguard/grafana-fips-12.4 pkg:apk/chainguard/grafana-fips-13.0 pkg:apk/wolfi/grafana-12.3 pkg:apk/wolfi/grafana-12.4 pkg:apk/wolfi/grafana-13.0
< 12.4.6-r0+ 11 more
- (no CPE)range: < 12.4.6-r0
- (no CPE)range: < 13.0.4-r0
- (no CPE)range: < 13.1.1-r0
- (no CPE)range: < 12.3.8-r2
- (no CPE)range: < 12.4.5-r2
- (no CPE)range: < 13.0.2-r5
- (no CPE)range: < 12.3.8-r3
- (no CPE)range: < 12.4.5-r2
- (no CPE)range: < 13.0.2-r2
- (no CPE)range: < 12.3.8-r2
- (no CPE)range: < 12.4.5-r2
- (no CPE)range: < 13.0.2-r5

Patches

Vulnerability mechanics

References

2

github.com/advisories/GHSA-cf98-j28v-49v6ghsaADVISORY
github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6ghsaWEB

News mentions

0

No linked articles in our index yet.