CVE-2026-48096

Analyzed Analyzed - Analysis Complete

Iterator Cache Key Collision in OpenFGA Authorization Engine

Publication date: 2026-06-10

Last updated on: 2026-06-12

Assigner: GitHub, Inc.

Description

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-12

Generated

2026-07-01

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-48096

EUVD

EUVD-2026-36061

Affected Vendors & Products

Vendor	Product	Version / Range
openfga	helm_charts	to 0.3.5 (exc)
openfga	openfga	to 1.16.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenFGA versions prior to 1.16.0 when iterator caching is enabled. Two different check requests can generate the same cache key, causing OpenFGA to reuse a cached result from an earlier request for a different subsequent request. This leads to incorrect authorization responses.

Impact Analysis

The vulnerability can cause OpenFGA to return incorrect authorization decisions by reusing cached results for different requests. This means a user might be granted or denied permissions incorrectly, potentially leading to unauthorized access or denial of legitimate access.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenFGA to version 1.16.0 or later, where the issue with cache key collisions and incorrect cached results has been fixed.

This update also includes other important fixes and improvements, such as datastore ping timeout configurations and authentication token handling enhancements.

Compliance Impact

The provided information does not specify how the vulnerability in OpenFGA affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Hi! I’m here to help you understand CVE-2026-48096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70