CVE-2026-40293

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

Apr 17, 2026, 8:47:06 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.29% · Oct 25, 2026

A flaw was found in OpenFGA, an authorization/permission engine. When OpenFGA is configured to use preshared-key authentication and the built-in playground is enabled and accessible beyond localhost or trusted networks, a remote attacker can exploit this vulnerability. The local server includes the preshared API key in the HTML response of the /playground endpoint, leading to information disclosure of the API key. This can allow unauthorized access to the system. OpenFGA: github.com/openfga/openfga: OpenFGA: Information disclosure of preshared API key via playground endpoint This is an Important information disclosure flaw in OpenFGA, an authorization engine used in Red Hat products. The vulnerability occurs when OpenFGA is configured with preshared-key authentication and its built-in playground is enabled and exposed beyond localhost or trusted networks. The /playground endpoint, intended for development, can then reveal the preshared API key, potentially leading to unauthorized access. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.