CVE-2026-41131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41131", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T12:59:15.737Z", "datePublished": "2026-04-21T23:38:29.955Z", "dateUpdated": "2026-04-22T18:14:31.408Z"}, "containers": {"cna": {"title": "OpenFGA has Improper Policy Enforcement", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-706", "lang": "en", "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6"}, {"name": "https://github.com/openfga/openfga/releases/tag/v1.14.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/openfga/openfga/releases/tag/v1.14.1"}], "affected": [{"vendor": "openfga", "product": "openfga", "versions": [{"version": "< 1.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:38:29.955Z"}, "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix."}], "source": {"advisory": "GHSA-57j5-qwp2-vqp6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:14:19.206614Z", "id": "CVE-2026-41131", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:14:31.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:14:19.206614Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:14:26.263Z"}}], "cna": {"title": "OpenFGA has Improper Policy Enforcement", "source": {"advisory": "GHSA-57j5-qwp2-vqp6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openfga", "product": "openfga", "versions": [{"status": "affected", "version": "< 1.14.1"}]}], "references": [{"url": "https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6", "name": "https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openfga/openfga/releases/tag/v1.14.1", "name": "https://github.com/openfga/openfga/releases/tag/v1.14.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-706", "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:38:29.955Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41131", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:14:31.408Z", "dateReserved": "2026-04-17T12:59:15.737Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T23:38:29.955Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openfga", "vendor": "openfga", "versions": [{"status": "affected", "version": "< 1.14.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openfga:helm_charts:*:*:*:*:*:openfga:*:*", "matchCriteriaId": "8E5C9CC5-31C7-4307-89E8-513DB9C4E1A8", "versionEndExcluding": "0.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD90DCAE-2F12-4225-9B25-6DACB03F56C7", "versionEndExcluding": "1.14.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix."}, {"lang": "es", "value": "OpenFGA es un motor de autorizaci\u00f3n/permisos dise\u00f1ado para desarrolladores. Antes de la versi\u00f3n 1.14.1, en escenarios espec\u00edficos, los modelos que utilizan condiciones con el almacenamiento en cach\u00e9 habilitado pueden dar como resultado que dos solicitudes de verificaci\u00f3n diferentes produzcan la misma clave de cach\u00e9. Esto podr\u00eda resultar en que OpenFGA reutilice un resultado previamente almacenado en cach\u00e9 para una solicitud posterior. Las condiciones previas para la vulnerabilidad son que el modelo tenga relaciones que dependan de la evaluaci\u00f3n de condiciones y que el usuario tenga el almacenamiento en cach\u00e9 habilitado. OpenFGA v1.14.1 contiene una correcci\u00f3n."}], "id": "CVE-2026-41131", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41131", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T18:14:19.206614Z", "version": "2.0.3"}}]}, "published": "2026-04-22T00:16:29.013", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/openfga/openfga/releases/tag/v1.14.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-706"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "openfga: OpenFGA: Incorrect authorization decisions due to cache key collision", "id": "2460447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460447"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in OpenFGA, an authorization and permission engine. When certain authorization models use conditions with caching enabled, the system can incorrectly generate the same cache key for different requests. This error causes OpenFGA to reuse an outdated authorization decision, potentially leading to incorrect access controls. Such a flaw could allow an attacker to gain unauthorized access to information, perform unauthorized actions, or disrupt service availability."], "name": "CVE-2026-41131", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Fix deferred", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}], "public_date": "2026-04-21T23:38:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41131\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41131\nhttps://github.com/openfga/openfga/releases/tag/v1.14.1\nhttps://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.14.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openfga", "source": "cna", "vendor": "openfga"}, "product": "openfga", "vendor": "openfga"}], "analysis": {"en": {"generated_at": "2026-04-29T01:54:28.405790+00:00", "value": {"mitigation_remediation": ["Update OpenFGA to version 1.14.1 or later to apply the vendor fix.", "Disable caching for any models that contain conditional relations until the update is applied, if such functionality is available.", "Implement monitoring for repeated cache keys or unintended permission gains to detect potential exploitation before patch deployment."], "summary": {"action": "Patch", "impact": "Unauthorized access via cached policy result"}, "threat_synthesis": {"affected_systems": "The affected product is OpenFGA (the openfga project). Versions prior to 1.14.1 are vulnerable, including all releases from the project's initial release up to 1.14.0. OpenFGA v1.14.1 and later contain the fix and are considered secure.", "description_and_impact": "OpenFGA, an authorization engine, can incorrectly enforce policies when conditions are used in models with caching enabled. The flaw allows a single cache key to be reused for distinct check requests, causing OpenFGA to return an earlier cached result instead of evaluating the new request. This improper policy enforcement can expose a user to a state that the model should not allow, thereby potentially granting unauthorized permissions. The vulnerability is classified as CWE-639, CWE-706 and CWE-863, reflecting a misuse of authorization logic and a failure to check authorization properly.", "risk_and_exploitability": "The CVSS score of 5 indicates medium severity, and the EPSS score is 0.0004, indicating a low but non\u2011zero exploit probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the model has conditions that influence authorization decisions and that the caching feature is enabled. An attacker must submit two check requests that generate an identical cache key but would normally produce different results. While the exact attack vector is not exhaustively detailed, it can be inferred that the attacker only needs the ability to craft requests to a target OpenFGA instance. The moderate CVSS score suggests exploitation is feasible but not trivial, and the lack of a readily available workaround means that only an updated version mitigates the risk. The overall risk is medium, with the potential to allow unintended access when caching is misused."}}}}, "created": "2026-04-22T01:30:05.070279+00:00", "updated": "2026-04-29T02:00:27.260025+00:00", "vendors": ["openfga", "openfga$PRODUCT$openfga"]}