CVE-2026-48096: OpenFGA cache key collision in iterator caching

Executive brief

OpenFGA, an open-source authorization engine, is vulnerable to a caching issue that could lead to incorrect access control decisions. When specific caching features are enabled, the system may confuse two different authorization requests and return a previously stored result for the wrong user or resource. This could allow unauthorized access to data or prevent legitimate users from performing actions.

Technical details

OpenFGA contains a cache-key delimiter injection vulnerability in its shared-iterator and v2 iterator components. When iterator caching is enabled (specifically SharedIteratorCache and ListObjectsIteratorCache), the system fails to properly distinguish between distinct check requests during key generation. This allows two different requests to produce the same cache key, leading to intra-store authorization-decision poisoning where a cached result from one request is incorrectly served for another. Attackers with low privileges can potentially exploit this over the network, though the attack complexity is high. The issue is addressed in version 1.16.0.

Affected products

• OpenFGA OpenFGA < 1.16.0

Timeline

• 2026-06-05: disclosed
• 2026-06-10: advisory: NVD publication
• 2026-06-11: advisory: GitHub Advisory published

References

• https://api.github.com/users/j4xT
• https://github.com/j4xT
• https://api.github.com/users/j4xT/gists%7B/gist_id%7D
• https://api.github.com/users/j4xT/repos
• https://avatars.githubusercontent.com/u/58428807?v=4
• https://api.github.com/users/j4xT/events%7B/privacy%7D