CVE-2026-41131: openfga helm charts +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2026-41131

CVSS 5.0 · Medium EPSS 0,23%

Kerentanan Use of Incorrectly-Resolved Name or Reference pada openfga helm charts, openfga. Skor CVSS 3.1 5.0 (Medium) menurut github.com.

Deskripsi (NVD)

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix.

Rincian

Terbit di NVD: 22 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-706: Use of Incorrectly-Resolved Name or Reference
CWE-863: Incorrect Authorization
EPSS (30 hari): 0,23% peluang dieksploitasi; lebih tinggi dari 12,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openfga	helm charts	Semua versi sebelum 0.3.1
openfga	openfga	Semua versi sebelum 1.14.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6 advisory vendor
https://github.com/openfga/openfga/releases/tag/v1.14.1 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.