GitHub Advisoryadvisory · Go
GHSA-cf98-j28v-49v6 OpenFGA Improper Policy Enforcement
LOW
Official page ↗
- Aliases
- CVE-2026-55170
- Ecosystem
- Go
- Packages
- github.com/openfga/openfga
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-178
- Reviewed
- 2026-06-18
Affected packages
• Go github.com/openfga/openfga: < 1.18.0 → fixed in 1.18.0
Description
Description
In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.
Preconditions
This applies if the following preconditions are met:
1. You run OpenFGA with MySQL as the datastore
2. Your authorization decisions rely on case-sensitive user strings.
Fix
Upgrade to OpenFGA 1.18.0 or greater.
Acknowledgements
OpenFGA would like to thank @sahajamoth for the detailed report.
Related
Alias · CVE (1)
- CVE-2026-55170 OpenFGA is an authorization/permission engine built for developers. vulnerability
Weakness · CWE (1)
- CWE-178 Improper Handling of Case Sensitivity weakness
References
- https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-55170 advisory
- https://github.com/openfga/helm-charts/commit/96d5517a2693ff5def451dee7d6b9d1baeb281f8 web
- https://github.com/openfga/openfga/commit/a2e0dbefc3e01a95c785f81a3563bc6571b08b11 web
- https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 web
- https://github.com/openfga/openfga package
- https://github.com/openfga/openfga/releases/tag/v1.18.0 web