CVE-2026-48096: openfga helm_charts
CVSS: 5.3v3.1MediumAnalyzed
AliasesCGA-4vqq-gpfw-6gx3CGA-7mc2-f5xf-qqcxCGA-8xrq-x72q-9v43CGA-mw47-5g9h-j6g5CGA-pfrg-cp6g-rq29CGA-v8vv-rg3w-329pGHSA-8396-jffm-qx4wGO-2026-5239CGA-2866-m326-mj5jCGA-28mq-mgr4-hwrhCGA-2xhw-r9hc-29cgCGA-397v-gxpm-wxx7CGA-433f-4xxr-9395CGA-4374-6556-pgxgCGA-4fc5-hq5c-q6rrCGA-5hvm-vxhm-qqw5CGA-5jcm-3jw9-cm48CGA-5xw8-fgm3-wpxfCGA-6fw8-q646-p47hCGA-6p9g-jmq7-mhjjCGA-79fg-cjw5-459cCGA-7wrq-222c-jqj2CGA-83vh-23g4-h2fcCGA-9ggm-jf45-83h8CGA-9ggq-c67f-gh44CGA-9hhr-wrj8-fcv3CGA-c6g8-7grx-454pCGA-g473-7p2g-v6jmCGA-ggx2-wx7m-9g99CGA-j543-8qj9-m2vmCGA-jgx9-6w97-4gvpCGA-jxv3-r6jj-4vg2CGA-mj9r-h2jf-mrggCGA-p6cw-636w-5rw2CGA-q673-82cm-989rCGA-q7x4-24hf-3937CGA-r3p9-5mg3-xjhmCGA-v365-3wq5-36x3CGA-vwfq-54gg-vq27CGA-w4q7-h6cv-4p4qCGA-w8g3-xrw3-64xrCGA-wqwq-6v6h-fcg6CGA-x5j4-hhgj-9m2cCGA-x7vc-9q7w-95vp
Published 10-06-2026Last modified 10-06-2026
Vulnerability summary
CVE-2026-48096 is a medium (CVSS 5.3) vulnerability in openfga helm_charts. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.13%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 10-06-2026PublishedVulnerability first disclosed.
- 10-06-2026Last modifiedVulnerability information updated.
Description
OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request. This issue has been patched in version 1.16.0.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSources5 sources · 5.0–5.3
- CVE.orgCNA5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · GoEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.03 pp
From 0.10% on 19-09-2026
19-09-202619-10-2026
EPSS score0.13%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Chainguard21 products
- commercial-grafana-11.6All versions (No fix recorded)
- commercial-grafana-12.1All versions (No fix recorded)
- commercial-grafana-12.2All versions (No fix recorded)
- commercial-grafana-12.3All versions (No fix recorded)
- commercial-grafana-12.4< 12.4.6-r0
Wolfi3 products
- grafana-12.3< 12.3.7-r1
- grafana-12.4< 12.4.4-r1
- grafana-13.0< 13.0.2-r4
Openfga2 products
- helm_charts< 0.3.5
- openfga< 1.16.0
Github.com/openfga1 product
- openfga< 1.16.0
4 vendors · 27 products
References
5 links- github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4wX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/openfga/openfgaPACKAGE