PT-2026-24688 · Flagd · Flagd

Danipalli · Published 2026-03-11 · Updated 2026-03-25 · CVE-2026-31866

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions flagd versions prior to 0.14.2

Description flagd, a feature flag daemon, exposes OFREP ('/ofrep/v1/evaluate/...') and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed for public access by client applications. The evaluation context within request payloads is read into memory without size limitations. An attacker can send a large HTTP request, causing flagd to allocate excessive memory, leading to process termination, such as an OOMKill in Kubernetes environments. flagd does not enforce authentication on its evaluation endpoints by default, and while operators may deploy it behind an authenticating reverse proxy, the endpoints themselves lack access control. The affected endpoints include: '/ofrep/v1/evaluate/flags/{flagKey}', '/ofrep/v1/evaluate/flags', flagd.evaluation.v1.Service/ResolveBoolean, flagd.evaluation.v1.Service/ResolveString, flagd.evaluation.v1.Service/ResolveFloat, flagd.evaluation.v1.Service/ResolveInt, flagd.evaluation.v1.Service/ResolveObject, flagd.evaluation.v1.Service/ResolveAll, flagd.evaluation.v2.Service/ResolveBoolean, flagd.evaluation.v2.Service/ResolveString, flagd.evaluation.v2.Service/ResolveFloat, flagd.evaluation.v2.Service/ResolveInt, flagd.evaluation.v2.Service/ResolveObject. This can lead to denial of service, service disruption, and repeated exploitation.

Recommendations Update flagd to version 0.14.2 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-31866

GHSA-RMRF-G9R3-73PM

GO-2026-4674

SUSE-SU-2026:1042-1

Affected Products

Flagd

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31866.json · Exploit
• https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm · Vendor Advisory
• https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3 · Patch
• https://osv.dev/vulnerability/GHSA-rmrf-g9r3-73pm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31866 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4674 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31866 · Security Note
• https://github.com/open-feature/flagd · Note
• https://suse.com/security/cve/CVE-2026-28682 · Note
• https://suse.com/security/cve/CVE-2026-30861 · Note
• https://suse.com/security/cve/CVE-2026-30915 · Note
• https://suse.com/security/cve/CVE-2026-29049 · Note
• https://suse.com/security/cve/CVE-2026-27808 · Note
• https://suse.com/security/cve/CVE-2026-26998 · Note