CVE-2026-48096: OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

June 11, 2026

In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.

References

github.com/advisories/GHSA-8396-jffm-qx4w
github.com/openfga/openfga/releases/tag/v1.16.0
github.com/openfga/openfga/security/advisories/GHSA-8396-jffm-qx4w
nvd.nist.gov/vuln/detail/CVE-2026-48096

Code Behaviors & Features

Detect and mitigate CVE-2026-48096 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →