CVE-2026-55689: 
Grafana vulnerability analysis and mitigation

CVE-2026-55689 is an improper authentication vulnerability in OpenFGA, an open-source authorization/permission engine, where the OIDC authenticator silently skipped JWT audience (aud) claim validation when authn.oidc.audience was not configured. This allowed a JWT token minted for an unrelated service by the same identity provider to successfully authenticate to OpenFGA. All versions up to and including v1.17.1 (Go module, Docker image) and Helm chart versions up to 0.3.8 are affected. The vulnerability was disclosed on June 18–19, 2026, and fixed in OpenFGA v1.18.0. It carries a CVSS v3.1 base score of 8.1 (High) per NVD, or 6.8 (Medium) per the GitHub advisory and ENISA EUVD (GitHub Advisory, Feedly).

The root cause is CWE-287 (Improper Authentication): in internal/authn/oidc/oidc.go, the Authenticate function conditionally appended the jwt.WithAudience() validation option only when authn.oidc.audience was a non-empty string. When the audience was left unconfigured (empty string), the JWT aud claim was never validated, meaning any validly-signed token from the trusted issuer was accepted regardless of its intended audience (GitHub Advisory, Patch Commit). Exploitation requires the attacker to already possess a valid JWT issued by the same identity provider (e.g., a token for another microservice in the same organization), and the OpenFGA instance must be running with authn.method=oidc and authn.oidc.issuer set but authn.oidc.audience absent. No special tooling beyond a standard HTTP client is needed to present the cross-service token to OpenFGA's API (GitHub Advisory).

A successful exploit allows an attacker holding a valid JWT for any service sharing the same identity provider to authenticate to OpenFGA and gain full access to its authorization API. This means the attacker can read and modify permission relationships and access control policies for all resources managed by the OpenFGA instance, resulting in high confidentiality and integrity impact with no availability impact (GitHub Advisory, Feedly). In multi-tenant or enterprise environments where OpenFGA governs access to many downstream services, unauthorized modification of authorization policies could enable lateral movement or privilege escalation across the entire application ecosystem.

1. Reconnaissance: Identify an OpenFGA instance configured with authn.method=oidc and authn.oidc.issuer set, but without authn.oidc.audience configured. This may be discoverable via misconfiguration audits, exposed configuration files, or error messages.
2. Obtain a cross-service JWT: Acquire a valid JWT token issued by the same identity provider (IdP) that OpenFGA trusts, but minted for a different service (e.g., another internal API or application sharing the same IdP). This could be obtained through legitimate access to that other service.
3. Present the token to OpenFGA: Send an authenticated API request to the OpenFGA instance (e.g., a POST /stores/{store_id}/check or GET /stores endpoint) using the cross-service JWT as a Bearer token in the Authorization header.
4. Bypass audience validation: Because authn.oidc.audience is not set, OpenFGA skips the aud claim check and accepts the token as valid, granting the attacker authenticated access.
5. Read or modify authorization policies: Use the authenticated session to enumerate, read, or write authorization tuples and relationship models, potentially escalating privileges or granting unauthorized access to resources managed by OpenFGA (GitHub Advisory, Patch Commit).

• Logs: OpenFGA access logs showing authenticated API requests (e.g., to /stores, /check, /write, /read) from clients presenting JWTs whose aud claim does not match the expected OpenFGA audience value; JWT aud claims referencing unrelated services in authentication logs.
• Network: Unexpected API calls to OpenFGA endpoints from IP addresses or service accounts not associated with known OpenFGA clients; unusual volume of authorization read/write operations.
• Configuration: OpenFGA deployments where authn.method=oidc is set but OPENFGA_AUTHN_OIDC_AUDIENCE / --authn-oidc-audience is absent or empty — this is the precondition for vulnerability and should be treated as a finding in itself (GitHub Advisory).

Upgrade OpenFGA to version v1.18.0 or later; for Helm chart deployments, upgrade to openfga-0.3.9 or later (GitHub Release, Helm Release). As of v1.18.0, OpenFGA refuses to start in OIDC mode unless both authn.oidc.issuer and authn.oidc.audience are explicitly set, and the aud claim is always validated. As an immediate workaround prior to upgrading, explicitly configure the authn.oidc.audience parameter (via --authn-oidc-audience flag or OPENFGA_AUTHN_OIDC_AUDIENCE environment variable) to enforce audience validation (GitHub Advisory).

The vulnerability was reported by security researcher @0xVijay and acknowledged in the official OpenFGA v1.18.0 release notes (GitHub Release). Red Hat tracked the issue via Bugzilla (bug #2498818) and published a CVE advisory, indicating awareness among enterprise Linux distribution maintainers. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability disclosure channels.