Read the docs
TI-2026-29074 Aliases CVE-2026-40293GHSA-68m9-983m-f3v5

OpenFGA Playground Preshared Key Exposure

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Fix Partial openfga (openfga): 1.14.0github.com/openfga/openfga (Go): 1.14.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openfgaopenfga0.1.4 to before 1.14.01.14.0Patch availableCNA
—github.com/openfga/openfga (Go)0.1.4 to before 1.14.01.14.0Patch availableGHSA-68m9-983m-f3v5
  • openfga Vendoropenfga Affected 0.1.4 to before 1.14.0 Fixed in 1.14.0 Patch available CNA
  • github.com/openfga/openfga (Go) Vendor— Affected 0.1.4 to before 1.14.0 Fixed in 1.14.0 Patch available GHSA-68m9-983m-f3v5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*0.1.4 to before 1.14.0Vulnerableopenfga
  • cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions 0.1.4 to before 1.14.0 Vulnerable ·openfga

Remediation

  • Fix · CNA openfga (openfga) Fixed in 1.14.0
  • Fix · GHSA-68m9-983m-f3v5 github.com/openfga/openfga (Go) Fixed in 1.14.0 Advisory →

Red Hat 3 advisories

  • RHSA-2026:36882 Released 2026-07-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
  • RHSA-2026:24539 Released 2026-06-08 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
  • RHSA-2026:24503 Released 2026-06-08 · Red Hat rating Important
    Multicluster Global Hub 1.7.1 security update
    • Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 9AffectedNo fix planned: Out of support scope
Multicluster Global Hub 1.7.3Fixed RHSA-2026:24503
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:36882
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:24539
Not affected: 3 products
  • Multicluster Global Hub 1.7.3
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40293
  2. 2026-10-03 Alias added: GHSA-68m9-983m-f3v5

References

Advisory 2

Other 2

  • TI-2023-17995 OpenFGA denial of service die to circular relationship CVSS 3.1HIGH 7.5
  • TI-2024-28441 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-07597 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2024-20816 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18717 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
  • TI-2022-18716 OpenFGA Authorization Bypass CVSS 3.1CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences