CVE-2026-55689
Fixed in a distro release EPSS <1%CVSS 6.8
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.
Products: openfga
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/openfga/openfga | 1.18.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-grafana-11.6 | no fix |
| Chainguard | commercial-grafana-12.1 | no fix |
| Chainguard | commercial-grafana-12.2 | no fix |
| Chainguard | commercial-grafana-12.3 | no fix |
| Chainguard | commercial-grafana-12.4 | 12.4.6-r0 |
| Chainguard | commercial-grafana-13.0 | 13.0.4-r0 |
| Chainguard | commercial-grafana-13.1 | 13.1.1-r0 |
| Chainguard | grafana-11.6 | 11.6.16-r13 |
| Chainguard | grafana-12.0 | no fix |
| Chainguard | grafana-12.1 | 12.1.10.01-r23 |
| Chainguard | grafana-12.2 | 12.2.10-r13 |
| Chainguard | grafana-12.3 | 12.3.8-r2 |
| Chainguard | grafana-12.4 | 12.4.5-r2 |
| Chainguard | grafana-fips-11.6 | 11.6.16-r16 |
| Chainguard | grafana-fips-12.0 | no fix |
| Chainguard | grafana-fips-12.1 | no fix |
| Chainguard | grafana-fips-12.2 | 12.2.10-r8 |
| Chainguard | grafana-fips-12.3 | 12.3.8-r3 |
| Chainguard | grafana-fips-12.4 | 12.4.5-r2 |
| Chainguard | grafana-fips-13.0 | 13.0.2-r2 |
| Wolfi | grafana-12.3 | 12.3.8-r2 |
| Wolfi | grafana-12.4 | 12.4.5-r2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |