CVE-2026-48096mediumCWE-345CWE-668

CVE-2026-48096: medium-severity vulnerability in openfga

OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

Published

Follow this CVE+ Monitor openfga+ Monitor github.com/openfga/openfga

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5epss 0.1%
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
openfga · openfga
Related CVEs — openfga

In the same product, most dangerous first.

CVE-2022-39341MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2022-39342MEDIUMOpenFGA Authorization BypassEPSS 1.1%CVE-2023-35933MEDIUMOpenFGA denial of service die to circular relationshipEPSS 1.1%CVE-2022-23542HIGHOpenFGA Authorization BypassEPSS 1.0%CVE-2023-43645MEDIUMDenial of service from circular relationship definitions in OpenFGAEPSS 0.9%CVE-2022-39340MEDIUMOpenFGA Information DisclosureEPSS 0.9%