OP
Product
openfga
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 7Medium 9Low 0
Watch
Add openfga to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40293 | 6.5 | Apr 17 | OpenFGA Playground Preshared Key Exposure Affected: >= 0.1.4, < 1.14.0 |
| CVE-2024-23820 | 6.5 | Jan 26 | OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3 Affected: before 1.4.3 |
| CVE-2023-40579 | 6.5 | Aug 25 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.3.1 |
| CVE-2023-43645 | 5.9 | Sep 27 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar Affected: before 1.3.2 |
| CVE-2026-55170 | 5.4 | Jul 9 | OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions Affected: < 1.18.0 |
| CVE-2026-61709 | 5.3 | Sep 16 | OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user Affected: < 1.18.1 |
| CVE-2026-48096 | 5.3 | Jun 10 | OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning Affected: < 1.16.0 |
| CVE-2022-39340 | 5.3 | Oct 25 | OpenFGA Information Disclosure Affected: < 0.2.4 |
| CVE-2026-41131 | 5.0 | Apr 21 | OpenFGA has Improper Policy Enforcement Affected: < 1.14.1 |
Showing 9