CVE-2026-48096 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning

🗓️ 10 Jun 2026 15:09:59Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

OpenFGA cache-key delimiter injection poisons intra-store authorizations; fixed 1.16.0.

Reporter	Title	Published	Views	Family All 34
Chainguard	CVE-2026-48096 vulnerabilities	13 Jun 202601:18	–	cgr
CNNVD	OpenFGA 数据伪造问题漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-48096	10 Jun 202615:09	–	cve
Cvelist	CVE-2026-48096 OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning	10 Jun 202615:09	–	cvelist
EUVD	EUVD-2026-36061	11 Jun 202620:28	–	euvd
Github Security Blog	OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning	11 Jun 202620:28	–	github
NVD	CVE-2026-48096	10 Jun 202616:17	–	nvd
OSV	CGA-MVJP-52PQ-9XXR	12 Jun 202621:11	–	osv
OSV	GHSA-8396-JFFM-QX4W OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning	11 Jun 202620:28	–	osv
OSV	GO-2026-5239 OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning in github.com/openfga/openfga	25 Jun 202618:43	–	osv

Source	Link
github	www.github.com/openfga/openfga/releases/tag/v1.16.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48096.json
github	www.github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48096

08 Jul 2026 08:13Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15

EPSS0.00101

OpenFGA cache key delimiter injection intra store authorization poisoning version 1.16.0