CVE-2026-48096 OpenFGA Cache Collision Vulnerability: Impact, Patching & Detection

Technical summary

CVE-2026-48096 is a cache collision vulnerability in OpenFGA's iterator caching mechanism. Under specific conditions, two distinct authorization check requests generate identical cache keys, causing OpenFGA to return a previously cached result instead of evaluating the new request independently. This violates the principle that each authorization decision should be context-specific. The vulnerability is rooted in insufficient cache key uniqueness (CWE-345: Insufficient Verification of Data Authenticity, CWE-668: Operation on a Resource After Expiration or Release). Exploitation requires an authenticated user with sufficient privileges to trigger multiple check requests that collide in the cache.

Business impact

This vulnerability could lead to authorization bypass or incorrect permission enforcement in applications relying on OpenFGA. A legitimate user denied access to a resource could potentially gain access if their request collides with a previously cached approval from another user. Conversely, an authorized user might be incorrectly denied if a cached denial is reused. In production environments managing critical access controls, this could expose sensitive data, enable unauthorized actions, or disrupt legitimate workflows. The CVSS score of 5.0 reflects the need for authentication and harder exploitation path, but the integrity and confidentiality impact remains material.

Affected systems

OpenFGA versions prior to 1.16.0 are vulnerable. This includes the openfga/openfga package and openfga/helm_charts deployments. Any deployment with iterator caching explicitly enabled is at risk. Organizations using OpenFGA for access control in Kubernetes environments (via Helm charts) or as a direct service should prioritize validation.

Exploitability

Exploitation requires an authenticated user with login privileges and the ability to craft specific authorization check requests that collide in the cache. The attack is not trivial—an attacker must understand the caching implementation and timing to reliably trigger collisions. The CVSS vector (AC:H, PR:L) indicates high attack complexity and low privilege requirements, meaning the barrier to exploitation is moderate but not trivial. No public exploit code or active in-the-wild exploitation has been documented.

Remediation

Upgrade OpenFGA to version 1.16.0 or later immediately. Verify the upgrade through your package manager (Go packages, Helm repositories) and validate the patch in your deployment logs. As an interim measure, disabling iterator caching (if operationally feasible) will eliminate the vulnerability, though this may impact performance. Verify configuration settings post-upgrade to ensure caching is correctly re-enabled if required.

Patch guidance

Update openfga/openfga to version 1.16.0 or later. For Helm-based deployments, update openfga/helm_charts to a version that references the patched OpenFGA binary (verify the Helm chart's appVersion field points to 1.16.0+). Test the patch in a staging environment first to confirm compatibility with your authorization policies and to measure any performance impact. Review your deployment's cache configuration after patching to ensure it aligns with your security and performance requirements.

Detection guidance

Monitor OpenFGA logs for unexpected authorization decisions, particularly patterns where the same check request returns different results on subsequent calls. Audit access control decisions around sensitive resources to identify discrepancies. Review cache hit rates and timing anomalies. If you have APM or authorization event logging in place, look for sequences where a denial is followed by an approval for the same user-resource pair within a short time window. Check your OpenFGA version via the /health or version endpoint to confirm whether you are running a vulnerable build.

Why prioritize this

Although this vulnerability carries a CVSS score of 5.0 (medium) and is not yet in the CISA KEV catalog, it directly affects access control logic—a critical security function. Any flaw in authorization systems, even with moderate exploitability, warrants urgent attention because it undermines the foundation of least-privilege security models. Organizations should treat this as a high-priority patch in their roadmap, especially if OpenFGA controls access to sensitive data or critical systems.

Risk score, explained

The CVSS 3.1 score of 5.0 reflects a Medium severity rating. The score accounts for network accessibility (AV:N), high attack complexity requiring cache collision timing (AC:H), requirement for authenticated access (PR:L), and confidentiality, integrity, and availability impacts (C:L, I:L, A:L) limited to the user's own authorization context. The moderate score does not diminish the importance of patching; it reflects that exploitation is difficult to pull off reliably, but not impossible for a skilled attacker with system knowledge.

Frequently asked questions