Junglewise Threat Intelligence

CVE-2026-40293: OpenFGA API key exposure in playground endpoint

CVE-2026-40293 · Severity: medium · CVSS 6.5 · Published 2026-04-17

Executive brief

OpenFGA is a system used by developers to manage user permissions and access control. A security issue exists where the system's 'playground'— a tool meant for testing and development—accidentally reveals the master API key in its web response. If this testing tool is accessible over the internet, an unauthorized person could obtain the key and gain full control over the authorization system, potentially allowing them to bypass security rules or access sensitive data.

Technical details

OpenFGA is vulnerable to information exposure (CWE-200/CWE-201) when configured to use preshared-key authentication with the built-in playground enabled. The /playground endpoint, which is enabled by default and requires no authentication, includes the plaintext preshared API key in its HTML response. An unauthenticated remote attacker who can reach the playground endpoint can extract this key to gain unauthorized administrative access to the OpenFGA API. This vulnerability affects OpenFGA versions 0.1.4 through 1.13.1. Users should upgrade to v1.14.0 or disable the playground using the `--playground-enabled=false` flag.

Affected products

  • OpenFGA OpenFGA 0.1.4 - 1.13.1
  • Red Hat Multicluster Global Hub 1.7.1
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Ceph Storage 6, 9

Timeline

  • 2026-04-03: patched: OpenFGA v1.14.0 released
  • 2026-04-08: advisory: GitHub Security Advisory published
  • 2026-04-17: disclosed: CVE published to NVD
  • 2026-06-08: patched: Red Hat released security updates for affected products

References

Related threats