CVE-2026-40293: OpenFGA API key exposure in playground endpoint

CVE-2026-40293 · Severity: medium · CVSS 6.5 · Published 2026-04-17

OpenFGA is a system used by developers to manage user permissions and access control. A security issue exists where the system's 'playground'— a tool meant for testing and development—accidentally reveals the master API key in its web response. If this testing tool is accessible over the internet, an unauthorized person could obtain the key and gain full control over the authorization system, potentially allowing them to bypass security rules or access sensitive data.

Technologies: github.com/openfga/openfga (Go), OpenFGA, Red Hat Multicluster Global Hub. Vendors: Go, OpenFGA, Red Hat.

Quick answers

Is CVE-2026-40293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40293 being exploited in the wild.
How severe is CVE-2026-40293?
Medium severity, with a CVSS score of 6.5, published 17 April 2026.
Which products and versions are affected?
github.com/openfga/openfga (Go) >= 0.1.4, <= 1.13.1, SEMVER:introduced=0.1.4,fixed=1.14.0; OpenFGA 0.1.4 - 1.13.1; Red Hat Multicluster Global Hub 1.7.1.
Is there a fix for CVE-2026-40293?
Yes. github.com/openfga/openfga (Go): upgrade to 1.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40293 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40293?
Check whether you run github.com/openfga/openfga (Go), OpenFGA or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/openfga/openfga (Go): upgrade to 1.14.0 or later
    go get github.com/openfga/openfga@v1.14.0

Technical details

OpenFGA is vulnerable to information exposure (CWE-200/CWE-201) when configured to use preshared-key authentication with the built-in playground enabled. The /playground endpoint, which is enabled by default and requires no authentication, includes the plaintext preshared API key in its HTML response. An unauthenticated remote attacker who can reach the playground endpoint can extract this key to gain unauthorized administrative access to the OpenFGA API. This vulnerability affects OpenFGA versions 0.1.4 through 1.13.1. Users should upgrade to v1.14.0 or disable the playground using the `--playground-enabled=false` flag.

Affected products

  • OpenFGA OpenFGA 0.1.4 - 1.13.1
  • Red Hat Multicluster Global Hub 1.7.1
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Ceph Storage 6, 9

Identifiers

  • CVE-2026-40293
  • GHSA-68m9-983m-f3v5
  • GO-2026-5170

Timeline

  • 2026-04-03: patched: OpenFGA v1.14.0 released
  • 2026-04-08: advisory: GitHub Security Advisory published
  • 2026-04-17: disclosed: CVE published to NVD
  • 2026-06-08: patched: Red Hat released security updates for affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.