CVE-2026-40293

OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`

• CWE-200
• CWE-201

• https://github.com/openfga/openfga/releases/tag/v1.14.0Product, Release Notes
• https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5Mitigation, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24503
• https://access.redhat.com/errata/RHSA-2026:24539
• https://access.redhat.com/errata/RHSA-2026:36882
• https://access.redhat.com/security/cve/CVE-2026-40293
• https://bugzilla.redhat.com/show_bug.cgi?id=2459341
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40293.json

Published

Apr 17, 2026

Last Modified

Aug 10, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40287PraisonAI is a multi-agent teams system. Versions 4.5.138 an…8.4
• CVE-2026-40288PraisonAI is a multi-agent teams system. In versions below 4…9.8
• CVE-2026-40289PraisonAI is a multi-agent teams system. In versions below 4…9.1
• CVE-2026-4029The Database Backup for WordPress plugin for WordPress is vu…7.5
• CVE-2026-40290OP-TEE is a Trusted Execution Environment (TEE) designed as …7.8
• CVE-2026-40291Chamilo LMS is an open-source learning management system. In…8.8
• CVE-2026-40295Devise is an authentication solution for Rails based on Ward…6.1
• CVE-2026-40296PhpSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2026-40299next-intl provides internationalization for Next.js. Applica…6.9
• CVE-2026-4030The Database Backup for WordPress plugin for WordPress is vu…8.1
• CVE-2026-40300Zulip is an open-source team collaboration tool. Prior to 12…6.5
• CVE-2026-40301DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Pri…4.7