CVE-2026-31866

flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2.

• CWE-770

• https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3Patch
• https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pmVendor Advisory

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31860Unhead is a document head and template manager. Prior to 2.1…6.1
• CVE-2026-31861Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31862Cloud CLI (aka Claude Code UI) is a desktop and mobile UI fo…8.8
• CVE-2026-31863Anytype Heart is the middleware library for Anytype. The cha…4.4
• CVE-2026-31864JumpServer is an open source bastion host and an operation a…6.8
• CVE-2026-31865Elysia is a Typescript framework for request validation, typ…5.3
• CVE-2026-31867Craft Commerce is an ecommerce platform for Craft CMS. Prior…4.8
• CVE-2026-31868Parse Server is an open source backend that can be deployed …6.1
• CVE-2026-31869Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-3187A vulnerability was identified in feiyuchuixue sz-boot-paren…9.8
• CVE-2026-31870cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-31871Parse Server is an open source backend that can be deployed …9.8