CVE-2025-55213
📋 TL;DR
OpenFGA versions 1.9.3 to 1.9.4 contain an improper policy enforcement vulnerability in Check and ListObject calls. This allows attackers to bypass authorization controls and access resources they shouldn't have permission to view or modify. Organizations using OpenFGA for authorization decisions in their applications are affected.
💻 Affected Systems
- OpenFGA
📦 What is this software?
Helm Charts by Openfga
Openfga by Openfga
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to all protected resources, data exfiltration, privilege escalation, and system compromise.
Likely Case
Partial authorization bypass leading to unauthorized data access, privilege escalation for specific users, and policy enforcement failures.
If Mitigated
Limited impact due to defense-in-depth controls, network segmentation, and additional authorization layers catching bypass attempts.
🎯 Exploit Status
Exploitation requires API access to make Check or ListObject calls, but the vulnerability itself is straightforward to trigger once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.5
Vendor Advisory: https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55
Restart Required: Yes
Instructions:
1. Update OpenFGA to version 1.9.5 or later. 2. For Helm deployments: helm upgrade openfga openfga/openfga --version 0.2.42+. 3. For Docker: docker pull openfga/openfga:1.9.5+. 4. Restart all OpenFGA instances. 5. Verify the update with version check commands.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to OpenFGA API endpoints to only trusted services and applications
# Example using iptables: iptables -A INPUT -p tcp --dport 8080 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
🧯 If You Can't Patch
- Implement additional authorization layer before OpenFGA calls to validate requests independently
- Monitor all Check and ListObject API calls for suspicious patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check OpenFGA version via API: curl http://openfga-host:8080/version or check container/process versionCheck Version:
curl -s http://localhost:8080/version | grep versionVerify Fix Applied:
Confirm version is 1.9.5 or higher and test authorization policies with known bypass attempts📡 Detection & Monitoring
Log Indicators:
- Unusual patterns in Check/ListObject API calls
- Authorization failures followed by successful access
- High volume of authorization requests from single sources
Network Indicators:
- Unusual traffic to OpenFGA authorization endpoints
- Authorization bypass patterns in API requests
SIEM Query:
source="openfga" AND (api_call="Check" OR api_call="ListObjects") AND result="allowed" AND user NOT IN authorized_users