TI-2026-39856 Aliases CVE-2026-55170 GHSA-cf98-j28v-49v6

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

LOW 11CWE-178Published 2026-07-09 · Updated 2026-07-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00339 27th percentileScored 2026-11-07

Fix Partial openfga (openfga): 1.18.0github.com/openfga/openfga (Go): 1.18.0Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openfga	openfga	before 1.18.0	1.18.0	Patch available	CNA
—	github.com/openfga/openfga (Go)	before 1.18.0	1.18.0	Patch available	GHSA-cf98-j28v-49v6

openfga Vendoropenfga Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA
github.com/openfga/openfga (Go) Vendor— Affected before 1.18.0 Fixed in 1.18.0 Patch available GHSA-cf98-j28v-49v6

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openfga:helm_charts::::::openfga::*	before 0.3.9	Vulnerable	openfga
cpe:2.3:a:openfga:openfga::::::::	before 1.18.0	Vulnerable	openfga

cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:* Versions before 0.3.9 Vulnerable ·openfga
cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:* Versions before 1.18.0 Vulnerable ·openfga

Remediation

Fix · CNA openfga (openfga) Fixed in 1.18.0
Fix · GHSA-cf98-j28v-49v6 github.com/openfga/openfga (Go) Fixed in 1.18.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Multicluster Global Hub	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 6	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 7	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 8	Affected	No fix yet: Fix deferred
Red Hat Ceph Storage 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-55170
2026-10-03 Alias added: GHSA-cf98-j28v-49v6

References

Patch 2

Advisory 2

Other 3

TI-2026-27194 Incorrect authorization in openfga CVSS 3.1HIGH 8.8
TI-2026-40204 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset CVSS 3.1HIGH 8.1
TI-2025-30697 OpenFGA Authorization Bypass CVSS 4.0MEDIUM 5.8
TI-2026-20050 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
TI-2025-40089 OpenFGA Improper Policy Enforcement CVSS 4.0MEDIUM 5.8
TI-2025-34888 OpenFGA Authorization Bypass (Check) CVSS 4.0MEDIUM 5.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences