CVE-2026-48096: OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning
Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.
Preconditions This applies if the following preconditions are present:
- FGA runs with SharedIteratorCache enabled, - FGA runs with ListObjectsIteratorCache enabled.
Fix Upgrade to version 1.16.0 or greater.
Acknowledgements OpenFGA would like to thank @j4xT for the discovery and the detailed report.
Other sources
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/openfga/openfgato a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48096?
The severity of CVE-2026-48096 is rated as medium with a score of 5.
How do I fix CVE-2026-48096?
To fix CVE-2026-48096, upgrade OpenFGA to version 1.16.0 or later.
What causes CVE-2026-48096?
CVE-2026-48096 is caused by two distinct check requests producing the same cache key due to a cache-key delimiter injection.
What impact does CVE-2026-48096 have?
CVE-2026-48096 allows intra-store authorization-decision poisoning, which may lead to unauthorized access.
Is caching affected by CVE-2026-48096?
Yes, the issue occurs when iterator caching is enabled in OpenFGA.