PT-2026-32978 · Openfga · Openfga

Bugbunny-Research · CVE-2026-40293 · Published 2026-04-08 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenFGA versions 0.1.4 through 1.13.1

Description When configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the '/playground' endpoint. This endpoint is enabled by default and does not require authentication, as it is intended for local development and debugging rather than production environments. The issue affects instances running with the --authn-method set to preshared, where the playground is enabled and accessible beyond localhost or trusted networks.

Recommendations Upgrade to OpenFGA version 1.14.0. Disable the playground by running ./openfga run --playground-enabled=false.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

CVE-2026-40293

GHSA-68M9-983M-F3V5

GO-2026-5170

OPENSUSE-SU-2026:21483-1

Affected Products

Openfga

References · 1754

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40293.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40293 · Security Note
• https://osv.dev/vulnerability/GHSA-68m9-983m-f3v5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40293 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24503 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5170 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24539 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/openfga/openfga/releases/tag/v1.14.0 · Note
• https://github.com/openfga/openfga · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note