CVE-2026-24851: 
NixOS vulnerability analysis and mitigation

CVE-2026-24851 is an improper policy enforcement vulnerability in OpenFGA, a high-performance authorization/permission engine inspired by Google Zanzibar. It affects OpenFGA versions v1.8.5 through v1.11.2 (Go module, Docker images), and Helm chart versions openfga-0.2.22 through openfga-0.2.51. The vulnerability was published on February 5, 2026, and fixed in v1.11.3 (Helm chart 0.2.52). It carries a CVSS v4 base score of 5.8 (Medium) and a CVSS v3.1 base score of 8.8 (High) (Github Advisory, OpenFGA Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization), where OpenFGA's Check API fails to correctly evaluate authorization policy under a specific combination of tuple configurations. The flaw is triggered when a model has a relation assignable by both type-bound public access (wildcard) and non-public access, and the datastore contains: (1) a public-access tuple for the relation, (2) a non-public tuple for the same object and relation, and (3) a non-public tuple for a different object whose ID is lexicographically larger than the first object, with the same user and relation. Under these conditions, the ordered iterator used during tuple evaluation processes tuples incorrectly, causing the Check call to return an erroneous authorization result. The fix in v1.11.3 corrects the ordered iterator to iterate tuples correctly (Github Advisory, OpenFGA Release).

Successful exploitation allows an authenticated low-privileged attacker to bypass authorization checks enforced by OpenFGA, potentially gaining unauthorized access to protected resources in downstream systems that rely on OpenFGA for access control decisions. Because OpenFGA is commonly used as a centralized authorization layer, a policy enforcement bypass can have cascading effects on confidentiality, integrity, and availability of all systems and data governed by the affected authorization model. The CVSS v4 scoring reflects high subsequent-system impact across confidentiality, integrity, and availability, even though the vulnerable system itself is not directly compromised (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires low privileges (an authenticated user) and specific preconditions in the authorization model and tuple configuration, which limits opportunistic exploitation. The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by researcher @henry781 (Github Advisory, OpenFGA Release).

1. Identify a vulnerable deployment: Confirm the target is running OpenFGA v1.8.5–v1.11.2 (or Helm chart openfga-0.2.22–0.2.51).
2. Analyze the authorization model: Inspect the OpenFGA model to identify a relation that is directly assignable by both type-bound public access (e.g., user:*) and non-public (specific user) access.
3. Verify tuple configuration: Confirm the datastore contains (a) a public-access tuple for the target object/relation, (b) a non-public tuple for the same object/relation, and (c) a non-public tuple for a different object whose ID is lexicographically larger, with the same user and relation.
4. Craft a Check request: As a low-privileged authenticated user, issue a Check API call targeting the object and relation where the misconfiguration exists, exploiting the iterator ordering bug to receive an incorrect allowed: true response.
5. Leverage unauthorized access: Use the erroneous authorization grant to access resources or perform actions in downstream systems that rely on OpenFGA's Check response for access control decisions (Github Advisory, OpenFGA Advisory).

• Logs: Unexpected allowed: true responses from OpenFGA Check API calls for users or objects that should not have access, particularly involving relations with mixed public/non-public tuple assignments.
• Network: Unusual or repeated Check API requests from low-privileged accounts targeting sensitive object/relation combinations in OpenFGA audit logs.
• Application: Access to downstream resources by users who should be denied based on the intended authorization model; discrepancies between expected and actual authorization decisions in application-level audit trails.

The vendor has released a patch in OpenFGA v1.11.3 (Go/Docker) and Helm chart version 0.2.52, which corrects the ordered iterator logic responsible for the incorrect tuple evaluation. The upgrade is backwards compatible, and no configuration changes are required. There is no documented workaround — upgrading to v1.11.3 is the only remediation (OpenFGA Advisory, OpenFGA Release).

The vulnerability was responsibly disclosed by researcher @henry781 and acknowledged in the OpenFGA v1.11.3 release notes. The advisory was published by OpenFGA maintainer @adriantam on February 5, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified.