2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55170

CVE-2026-55170: OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55170

CVE-2026-55170:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openfga/openfga	go	< 1.18.0	1.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the MySQL database, when used as a datastore for OpenFGA, was configured with a case-insensitive collation by default. This caused identifiers (like usernames or object types) that only differed in case to be treated as the same. For example, user:Alice and user:alice would be considered identical. This could lead to improper authorization checks, where a user might be granted access they shouldn't have, or denied access they should have.

The fix for this vulnerability was to change the collation of the identifier columns in the MySQL database schema to utf8mb4_bin, which is a case-sensitive collation. This ensures that identifiers are compared in a case-sensitive manner, which is the expected behavior for OpenFGA.

The patch does not modify any Go code directly, but it changes the database schema. The vulnerable functions are the ones that interact with the database to read and write data, as their behavior is affected by the database's collation. The new test file pkg/storage/test/collation.go added in the patch explicitly tests the read paths (Read, ReadUserTuple, ReadChanges, ReadAuthorizationModel) to ensure they are now case-sensitive. The write paths (Write, WriteAuthorizationModel) are also included as they are responsible for storing the data that is later read.

Vulnerable functions

storage.OpenFGADatastore.Read

pkg/storage/test/collation.go

The `Read` function is used to retrieve tuples from the database. Before the patch, if the database was case-insensitive (like MySQL by default), this function would not differentiate between identifiers that only differ in case, leading to incorrect authorization checks. The patch adds a test that verifies this function now correctly handles case-sensitive identifiers.

storage.OpenFGADatastore.ReadUserTuple

pkg/storage/test/collation.go

The `ReadUserTuple` function is used to retrieve a specific tuple from the database. Similar to `Read`, this function was vulnerable to case-insensitivity issues in the database, which could lead to incorrect authorization checks. The patch adds a test to ensure this function is now case-sensitive.

storage.OpenFGADatastore.ReadChanges

pkg/storage/test/collation.go

The `ReadChanges` function is used to read the changelog. This function was also affected by the case-insensitivity of the database, which could lead to incorrect results when filtering by object type. The patch includes a test to verify that this function now correctly handles case-sensitive object types.

storage.OpenFGADatastore.ReadAuthorizationModel

pkg/storage/test/collation.go

The `ReadAuthorizationModel` function retrieves an authorization model from the database. The vulnerability could also affect the types defined in the model if the database was case-insensitive. The patch adds a test to ensure that case-distinct type definitions are correctly retrieved.

storage.OpenFGADatastore.Write

pkg/storage/test/collation.go

The `Write` function is used to write tuples to the database. While the vulnerability is primarily in the read path, the `Write` function is also relevant as it is responsible for storing the data. If the database was case-insensitive, it might have stored the data in a way that loses case information. The patch ensures that the database now correctly stores case-sensitive identifiers.

storage.OpenFGADatastore.WriteAuthorizationModel

pkg/storage/test/collation.go

The `WriteAuthorizationModel` function is used to write an authorization model to the database. Similar to `Write`, this function is relevant because it is responsible for storing the authorization model. The patch ensures that the database now correctly stores case-sensitive type definitions in the model.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.