CVE-2026-40293: OpenFGA Information Disclosure Vulnerability

CVE-2026-40293 Overview

CVE-2026-40293 is an information exposure vulnerability in OpenFGA, an authorization and permission engine built for developers. When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server inadvertently includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default, does not require authentication, and is accessible without any authorization checks.

Critical Impact

Exposed preshared API keys can allow unauthorized access to the OpenFGA authorization engine, potentially enabling attackers to manipulate authorization policies, query sensitive permission data, or compromise the integrity of access control decisions across applications relying on OpenFGA.

Affected Products

• OpenFGA versions 0.1.4 through 1.13.1
• Deployments using --authn-method preshared authentication
• Instances with playground endpoint accessible beyond localhost or trusted networks

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-40293 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40293

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from the /playground endpoint embedding the preshared API key directly into its HTML response. The playground feature is designed as a development and debugging tool, intended only for local use. However, when exposed beyond localhost or trusted network boundaries, attackers can retrieve the API key without authentication.

The vulnerability requires a specific configuration combination: preshared-key authentication must be enabled (--authn-method preshared), the playground must be active (which is the default state), and the playground endpoint must be network-accessible to untrusted parties. Organizations that have inadvertently exposed their OpenFGA instances to the internet while using preshared-key authentication are at risk.

Root Cause

The root cause is the playground feature's design assumption that it would only be accessed in trusted development environments. The implementation did not account for scenarios where users might expose the playground endpoint to untrusted networks while using preshared-key authentication. The preshared API key is embedded in the client-side HTML/JavaScript to facilitate local testing, but this creates a sensitive data exposure when the endpoint is accessible externally.

Attack Vector

An attacker with network access to the /playground endpoint can perform a simple HTTP GET request to retrieve the HTML response containing the embedded preshared API key. Once obtained, the attacker can use this key to authenticate to the OpenFGA API and perform any authorized operations, including reading authorization models, querying relationships, and potentially modifying access control policies.

The attack requires no prior authentication, as the playground endpoint is intentionally unauthenticated to facilitate local development workflows. The attacker simply needs to access the /playground path and extract the API key from the response.

Detection Methods for CVE-2026-40293

Indicators of Compromise

• Unexpected external access attempts to the /playground endpoint from non-localhost IP addresses
• API requests authenticated with the preshared key originating from unknown or suspicious IP addresses
• Anomalous authorization model queries or relationship checks from unfamiliar sources
• Evidence of API key extraction in web server access logs showing GET requests to /playground

Detection Strategies

• Monitor web server and application logs for requests to the /playground endpoint from external IP addresses
• Implement network-level detection for traffic patterns indicating reconnaissance of OpenFGA endpoints
• Audit API authentication logs to identify preshared key usage from unexpected source addresses
• Deploy web application firewalls (WAF) with rules to alert on playground endpoint access from external networks

Monitoring Recommendations

• Configure alerting for any access to /playground from IP addresses outside trusted network ranges
• Establish baseline metrics for legitimate API key usage patterns to detect anomalous authentication activity
• Implement periodic security audits of OpenFGA deployment configurations to ensure playground is disabled in production
• Monitor for unauthorized changes to authorization models or relationship tuples that could indicate compromised API access

How to Mitigate CVE-2026-40293

Immediate Actions Required

• Upgrade OpenFGA to version v1.14.0 or later, which addresses this vulnerability
• If immediate upgrade is not possible, disable the playground by running ./openfga run --playground-enabled=false
• Rotate any preshared API keys that may have been exposed through the vulnerability
• Audit access logs to determine if the playground endpoint was accessed by unauthorized parties

Patch Information

OpenFGA version v1.14.0 resolves this vulnerability. Users should upgrade to this version or later to ensure the preshared API key is no longer exposed through the playground endpoint. The fix can be obtained from the GitHub Release v1.14.0. Additional details are available in the GitHub Security Advisory GHSA-68m9-983m-f3v5.

Workarounds

• Disable the playground endpoint entirely using the --playground-enabled=false flag when starting OpenFGA
• Restrict network access to the OpenFGA instance using firewall rules to limit exposure to trusted networks only
• Consider switching to alternative authentication methods such as OIDC if preshared-key authentication is not strictly required
• Implement reverse proxy configurations to block external access to the /playground path while allowing legitimate API traffic

# Configuration example
# Disable the playground endpoint to prevent API key exposure
./openfga run --playground-enabled=false

# Alternative: Use firewall rules to restrict playground access
# Example using iptables to allow only localhost
iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP