Go/github.com/openfga/openfga CVE-2026-40293: medium 6.5, EPSS 0.29%

OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response in github.com/openfga/openfga

Action: Upgrade github.com/openfga/openfga to 1.14.0 or later.

go get github.com/openfga/openfga@v1.14.0

Affected

Fixed versions

Sources

• osv: GO-2026-5170
• nvd: CVE-2026-40293
• https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5
• https://github.com/openfga/openfga/releases/tag/v1.14.0

CVE-2026-40293 · published 2026-06-25T18:26:48Z · modified 2026-07-07T22:59:27.331233716Z · JSON