CVE-2026-55170: OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
Description
In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.
Preconditions
This applies if the following preconditions are met:
1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive user strings.
Fix Upgrade to OpenFGA 1.18.0 or greater.
Acknowledgements OpenFGA would like to thank @sahajamoth for the detailed report.
Other sources
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55170?
The severity of CVE-2026-55170 is rated as risk level 34.
What vulnerability does CVE-2026-55170 address?
CVE-2026-55170 addresses a flaw in OpenFGA where two distinct check requests can return the same response when using MySQL as the datastore.
How do I fix CVE-2026-55170?
To fix CVE-2026-55170, ensure that your authorization decisions in OpenFGA are not solely reliant on case-sensitive checks when using MySQL.
What systems are affected by CVE-2026-55170?
CVE-2026-55170 affects systems running OpenFGA with MySQL as the datastore.
What are the implications of CVE-2026-55170 for my applications?
The implications of CVE-2026-55170 may include incorrect authorization outcomes leading to potential security risks.