Security readout for executives and security teams
Plain-English summary
OpenFGA can reveal its preshared API key inside the publicly accessible playground page. An unauthenticated visitor who can reach that page may obtain the secret used to authenticate API requests. Production systems are at risk only when preshared-key authentication, the enabled playground, and exposure beyond localhost or trusted networks occur together.
Executive priority
High priority for production deployments meeting all exposure conditions; remediate promptly because an unauthenticated network visitor could obtain an authentication secret. Lower the priority only after confirming the playground is disabled, inaccessible from untrusted networks, or preshared-key authentication is not used.
Technical view
OpenFGA versions 0.1.4 through 1.13.1 embed the configured preshared key in the HTML response from the unauthenticated /playground endpoint. Exploitation requires network access to that endpoint, preshared-key authentication, and the playground being enabled. The issue is classified as CWE-200 and CWE-201, with CVSS 3.1 score 7.5 for high confidentiality impact.
Likely exposure
Exposure is configuration-dependent. Prioritize internet-facing or broadly reachable OpenFGA deployments below version 1.14.0. Deployments using another authentication method, disabling the playground, or limiting it to localhost or trusted networks do not meet the stated vulnerable conditions.
Exploitation context
The disclosure requires no authentication, user interaction, or complex prerequisite beyond reaching the playground. The bundle reports no CISA KEV listing and provides no evidence of active exploitation. Treat accessible production instances urgently because the disclosed value is an authentication secret.
Researcher notes
The vulnerable behavior is secret inclusion in server-generated playground HTML, not a general OpenFGA authentication bypass. Scope validation should combine version, authentication mode, playground state, and network reachability. The supplied evidence supports confidentiality impact but does not establish secret use, downstream compromise, or exploitation in the wild.
Mitigation direction
- Upgrade OpenFGA to version 1.14.0 or later.
- Alternatively, start OpenFGA with the playground disabled.
- Restrict the playground endpoint to localhost or trusted networks while remediation is pending.
- Review current OpenFGA vendor guidance before applying environment-specific changes.
Validation and detection
- Inventory OpenFGA versions and identify deployments older than 1.14.0.
- Confirm whether each deployment uses preshared-key authentication.
- Confirm whether the built-in playground is enabled.
- Test whether /playground is reachable from untrusted networks without authentication.
- After remediation, verify the playground response no longer exposes the preshared key.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-201: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-40293 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhat-SADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5GitHub_MVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-17T22:01:37.276Z: Reported to Red Hat.
- 2026-04-17T20:47:06.804Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/openfga/openfga/releases/tag/v1.14.0CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-40293CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2459341CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40293.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:24503CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36882CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24539CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.