Nixpkgs security tracker

Untriaged

Permalink CVE-2026-55689

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 6 days, 4 hours ago Activity log

Created suggestion 6 days, 4 hours ago

OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated service by the same identity provider to authenticate to OpenFGA. This issue is fixed in 1.18.0.

References

https://github.com/openfga/openfga/security/advisories/GHSA-hcxc-wf8j-23hv x_refsource_CONFIRM
https://github.com/openfga/openfga/commit/44596773b2e62738720ef215bf7fa04352954271 x_refsource_MISC
https://github.com/openfga/helm-ch x_refsource_MISC
https://github.com/openfga/helm-charts/releases/tag/openfga-0.3.9 x_refsource_MISC
https://github.com/openfga/openfga/releases/tag/v1.18.0 x_refsource_MISC

Affected products

openfga

==< 1.18.0

Matching in nixpkgs

pkgs.openfga

High performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

nixos-unstable 1.16.1
- nixpkgs-unstable 1.18.0
- nixos-unstable-small 1.18.1
nixos-26.05 1.14.2
- nixos-26.05-small 1.14.2
- nixpkgs-26.05-darwin 1.14.2

pkgs.openfga-cli

Cross-platform CLI to interact with an OpenFGA server

nixos-unstable 0.7.15
- nixpkgs-unstable 0.7.16
- nixos-unstable-small 0.7.17
nixos-26.05 0.7.13
- nixos-26.05-small 0.7.13
- nixpkgs-26.05-darwin 0.7.13

pkgs.python313Packages.openfga-sdk

Fine-Grained Authorization solution for Python

nixos-unstable 0.10.3
- nixpkgs-unstable 0.10.3
- nixos-unstable-small 0.10.3
nixos-26.05 0.10.3
- nixos-26.05-small 0.10.3
- nixpkgs-26.05-darwin 0.10.3

pkgs.python314Packages.openfga-sdk

Fine-Grained Authorization solution for Python

nixos-unstable 0.10.3
- nixpkgs-unstable 0.10.3
- nixos-unstable-small 0.10.3
nixos-26.05 0.10.3
- nixos-26.05-small 0.10.3
- nixpkgs-26.05-darwin 0.10.3

Package maintainers

@jlesquembre José Luis Lafuente <jl@lafuente.me>
@nicklewis Nick Lewis <nick@nlew.net>

Untriaged

Permalink CVE-2026-55170

2.1 LOW

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): Low (L)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 6 days, 4 hours ago Activity log

Created suggestion 6 days, 4 hours ago

OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.