Most recent entries from all

Withdrawn: CLEANSTART-2026-KQ21500 — Security fixes in grafana 12.3.10-r1

2026-10-03T02:48:11.478600+00:00

Withdrawn by the publisher.

Affected: CleanStart: grafana

Package grafana version 12.3.10-r1 fixes 15 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...

EUVD-2026-335597

2026-10-03T02:48:11.478670+00:00

EUVD-2026-335597

fkie_cve-2026-55170

2026-10-03T02:48:11.478688+00:00

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

GHSA-cf98-j28v-49v6 — OpenFGA Improper Policy Enforcement

2026-10-03T02:48:11.478717+00:00

Affected: Go: github.com/openfga/openfga

## Description

In OpenFGA, when MySQL is being used as the datastore, two distinct check requests can return the same response.

## Preconditions

This applies if the following preconditions are met:

1. You run OpenFGA with MySQL as the datastore 2. Your authorization decisions rely on case-sensitive user strings.

## Fix Upgrade to OpenFGA 1.18.0 or greater.

## Acknowledgements OpenFGA would like to thank @sahajamoth for the detailed report.