PT-2026-32978 · Openfga · Openfga

Bugbunny-Research · Published 2026-04-08 · Updated 2026-04-27 · CVE-2026-40293

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenFGA versions 0.1.4 through 1.13.1

Description When configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the '/playground' endpoint. This endpoint is enabled by default and does not require authentication, as it is intended for local development and debugging rather than production environments. The issue affects instances running with the --authn-method set to preshared, where the playground is enabled and accessible beyond localhost or trusted networks.

Recommendations Upgrade to OpenFGA version 1.14.0. Disable the playground by running ./openfga run --playground-enabled=false.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-40293

GHSA-68M9-983M-F3V5

Affected Products

Openfga

References · 8

• https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40293 · Security Note
• https://osv.dev/vulnerability/GHSA-68m9-983m-f3v5 · Vendor Advisory
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/releases/tag/v1.14.0 · Note
• https://t.me/cveNotify/161144 · Telegram Post
• https://twitter.com/CVEnew/status/2045467396920447353 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045281064403218485 · Twitter Post