GHSA-68m9-983m-f3v5

Source

https://github.com/advisories/GHSA-68m9-983m-f3v5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-68m9-983m-f3v5/GHSA-68m9-983m-f3v5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-68m9-983m-f3v5

Aliases

Downstream

CGA (36)

MINI (18)

Published

2026-04-08T21:51:41Z

Modified

2026-09-10T03:50:43Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response

Details

Description

When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments.

Am I Affected?

You are affected if you meet each of the following preconditions:

You are running OpenFGA with --authn-method preshared, and
The playground is enabled, and
The playground endpoint is accessible beyond localhost or trusted networks.

Fix

Upgrade to OpenFGA v1.14.0, or disable the playground by running ./openfga run --playground-enabled=false.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-08T21:51:41Z",
    "nvd_published_at":  "2026-04-17T21:16:34Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/openfga/openfga

Package

Name: github.com/openfga/openfga; View open source insights on deps.dev
Purl: pkg:golang/github.com/openfga/openfga

Affected ranges

Type: SEMVER
Events: Introduced

0.1.4

Fixed

1.14.0

Database specific

last_known_affected_version_range

"<= 1.13.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-68m9-983m-f3v5/GHSA-68m9-983m-f3v5.json"