CVE-2025-46331
📋 TL;DR
OpenFGA versions 1.3.6 through 1.8.10 contain an authorization bypass vulnerability in Check and ListObject calls. This allows attackers to bypass permission checks and access unauthorized resources. All deployments using affected versions are vulnerable.
💻 Affected Systems
- OpenFGA
📦 What is this software?
Helm Charts by Openfga
Openfga by Openfga
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to all protected resources and data
Likely Case
Partial authorization bypass enabling access to specific resources that should be restricted
If Mitigated
Limited impact if additional authorization layers exist outside OpenFGA
🎯 Exploit Status
Exploitation requires API access but no authentication bypass; detailed advisory available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.11
Vendor Advisory: https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6
Restart Required: Yes
Instructions:
1. Update OpenFGA to version 1.8.11 or later
2. Update Helm chart to version > 0.2.28
3. Update Docker image to v1.8.11 or later
4. Restart OpenFGA service
🔧 Temporary Workarounds
Network segmentation
allRestrict network access to OpenFGA API endpoints
API gateway rate limiting
allImplement rate limiting on Check and ListObject API calls
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach OpenFGA API
- Add additional authorization layer before OpenFGA calls
🔍 How to Verify
Check if Vulnerable:
Check OpenFGA version: if between 1.3.6 and 1.8.10 inclusive, you are vulnerableCheck Version:
openfga versionVerify Fix Applied:
Confirm version is 1.8.11 or later and test authorization checks📡 Detection & Monitoring
Log Indicators:
- Unusual patterns of Check/ListObject calls
- Authorization failures followed by successful access
Network Indicators:
- High volume of Check/ListObject API calls from single source
SIEM Query:
source="openfga" AND (operation="Check" OR operation="ListObjects") | stats count by src_ip