CVE-2026-55170
Fixed in a distro release EPSS <1%CVSS 2.1
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.
Products: openfga
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openfga/openfga | 1.18.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.6-r0 |
| Chainguard | commercial-grafana-13.0 | 13.0.4-r0 |
| Chainguard | commercial-grafana-13.1 | 13.1.1-r0 |
| Chainguard | grafana-11.6 | 11.6.16-r13 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | 12.1.10.01-r23 |
| Chainguard | grafana-12.2 | 12.2.10-r13 |
| Chainguard | grafana-12.3 | 12.3.8-r2 |
| Chainguard | grafana-12.4 | 12.4.5-r2 |
| Chainguard | grafana-13.0 | 13.0.2-r5 |
| Chainguard | grafana-fips-11.6 | 11.6.16-r16 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | 12.2.10-r8 |
| Chainguard | grafana-fips-12.3 | 12.3.8-r3 |
| Chainguard | grafana-fips-12.4 | 12.4.5-r2 |
| Chainguard | grafana-fips-13.0 | 13.0.2-r2 |
| Wolfi | grafana-12.3 | 12.3.8-r2 |
| Wolfi | grafana-12.4 | 12.4.5-r2 |
| Wolfi | grafana-13.0 | 13.0.2-r5 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |