Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-09T21:04:28 github.com/openfga/openfga: OpenFGA: Incorrect authorization decisions due to case-insensitive comparisons in MySQL datastore 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CWE-178

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

A flaw was found in OpenFGA, an authorization/permission engine. When using MySQL as the datastore, and authorization decisions depend on case-sensitive user strings, the system may incorrectly treat case-distinct values (e.g., 'user:Alice' and 'user:alice') as equivalent. This can lead to improper policy enforcement, where two different authorization requests might receive the same, unintended response, potentially affecting access controls.

This flaw affects OpenFGA when MySQL is used as the datastore backend and authorization decisions rely on case-sensitive user identifiers. Red Hat does not ship OpenFGA as a standalone product. The affected code is bundled inside Grafana's experimental "Zanzana" authorization engine (which vendors github.com/openfga/openfga as a Go dependency), and Grafana itself is embedded in Red Hat Ceph Storage's dashboard, Red Hat Advanced Cluster Management, Multicluster Global Hub, and RHEL's grafana package. Zanzana is disabled by default in upstream Grafana (feature toggle zanzana=false, experimental) and none of these embedding products expose it as a supported, user-configurable OpenFGA/MySQL-backed authorization server, which significantly limits real-world exposure even though the vulnerable dependency ships as part of the bundled code. No mitigation is required for the affected Red Hat products, since none of them expose Grafana's Zanzana/OpenFGA authorization engine as a supported, user-facing feature backed by MySQL. Operators running a standalone, self-configured OpenFGA deployment with MySQL as the datastore should upgrade to OpenFGA 1.18.0 or later, which changes the MySQL identifier columns to a case-sensitive (utf8mb4_bin) collation. Multicluster Global Hub Fix deferred multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/acm-grafana-rhel9 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/grafana-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/grafana-rhel10 Red Hat Enterprise Linux 10 Fix deferred grafana https://www.cve.org/CVERecord?id=CVE-2026-55170 https://nvd.nist.gov/vuln/detail/CVE-2026-55170 https://github.com/openfga/helm-charts/commit/96d5517a2693ff5def451dee7d6b9d1baeb281f8 https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 https://github.com/openfga/openfga/commit/a2e0dbefc3e01a95c785f81a3563bc6571b08b11 https://github.com/openfga/openfga/releases/tag/v1.18.0 https://github.com/openfga/openfga/security/advisories/GHSA-cf98-j28v-49v6