Medium severity · published Jun 10, 2026
CVE-2026-48096
OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openfga · openfga
< 1.16.0 · source: vendor, NVD
HC
Helm Charts · Openfga
before 0.3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48096
Product
https://github.com/openfga/openfga/releases/tag/v1.16.0
Vendor Advisory
https://github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w
More from openfga
9.8
CVE-2026-33729
OpenFGA has an Authorization Bypass through cached keys
9.8
CVE-2025-55213
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar
9.8
CVE-2025-46331
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar
9.8
CVE-2025-25196
OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar
9.8
CVE-2024-56323
OpenFGA is an authorization/permission engine