要点
- CVE-2026-55170 は github.com/openfga/openfga, helm charts (openfga), openfga (openfga) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.34%（全脆弱性の 27.4% より高い）。
- 対処：1.18.0, 0.3.9 以降に更新してください。
概要
Description
In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.
Preconditions
This applies if the following preconditions are met:
- You run OpenFGA with MySQL as the datastore
- Your authorization decisions rely on case-sensitive user strings.
Fix
Upgrade to OpenFGA 1.18.0 or greater.
Acknowledgements
OpenFGA would like to thank @sahajamoth for the detailed report.
NVD の説明
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.
github.com/openfga/openfga のその他の脆弱性
すべて見る →これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン