Login Request a demo
OP
Product
openfga
by openfga · last CVE Sep 16, 2026
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities27In the news0Timeline
Severity mix
Critical 11High 7Medium 9Low 0
Severity
All severities27Critical11High7Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openfga to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34972
8.8
0%
Apr 6
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
Affected: >= 1.8.0, < 1.14.0
CVE-2026-24851
8.8
0%
Feb 6
OpenFGA Improper Policy Enforcement
Affected: < 1.11.3
CVE-2025-64751
8.8
0%
Nov 21
OpenFGA Improper Policy Enforcement
Affected: >= 1.4.0, < 1.11.1
CVE-2025-48371
8.8
1%
May 22
OpenFGA is an authorization/permission engine
Affected: 1.8.0 before 1.8.13
CVE-2026-55689
8.1
0%
Jul 9
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
Affected: < 1.18.0
CVE-2023-45810
7.5
1%
Oct 17
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar
Affected: before 1.3.4
CVE-2023-35933
7.5
1%
Jun 26
OPenFGA is an open source authorization/permission engine built for developers
Affected: before 1.1.1
Showing 7