What is the CVSS score of CVE-2026-40293?

CVE-2026-40293 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-40293?

Yes, a patch is available for CVE-2026-40293. Update the affected software to the latest version immediately.

Openfga CVE-2026-40293

MEDIUM

Information Exposure (CWE-200)

2026-04-17 GitHub_M

Information Disclosure Openfga

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 18, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 17, 2026 - 21:37 vuln.today

Analysis Generated

Apr 17, 2026 - 21:15 vuln.today

CVE Published

Apr 17, 2026 - 20:47 nvd

MEDIUM 6.5

DescriptionCVE.org

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with --authn-method preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running ./openfga run --playground-enabled=false.

AnalysisAI

OpenFGA 0.1.4 through 1.13.1 discloses preshared API authentication keys in plaintext HTML responses from the unauthenticated /playground endpoint when configured with preshared-key authentication. Remote attackers on accessible networks can retrieve credentials without authentication, compromising authorization service security. The vulnerability requires non-default configuration (preshared auth enabled, playground accessible beyond localhost), limiting but not eliminating real-world risk.

Technical ContextAI

OpenFGA is a developer-focused authorization engine using fine-grained access control policies. The /playground endpoint is an unauthenticated debugging interface enabled by default, intended only for local development on localhost. When OpenFGA runs with --authn-method preshared (a pre-shared API key authentication scheme), the server incorrectly embeds the plaintext preshared key directly into the HTML response served by /playground. This occurs at the HTTP application layer (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), where credentials are transmitted without encryption or redaction in a public-facing endpoint. The vulnerability affects all versions from 0.1.4 through 1.13.1 per the CPE cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to OpenFGA v1.14.0 or later, where the vulnerability is fixed. For users unable to upgrade immediately, disable the playground endpoint by running OpenFGA with the flag --playground-enabled=false, which eliminates the attack surface while preserving authentication functionality. This workaround is operationally safe for production deployments where playground access is not required, though it removes local debugging capabilities. Alternatively, enforce strict network segmentation to restrict /playground access to trusted localhost-only or whitelisted internal networks, using firewall rules or reverse proxy ACLs; this requires ongoing verification that playground remains unexposed and is less reliable than disabling the feature. Vendor-released patch: v1.14.0. References: https://github.com/openfga/openfga/releases/tag/v1.14.0