CVE-2026-55170: Openfga Helm Charts

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

Affected products

• Openfga Helm Charts: before 0.3.9 (fixed in 0.3.9)
• Openfga Openfga: before 1.18.0 (fixed in 1.18.0)

Published 2026-07-09. Last modified 2026-07-14.