StackRadarChart IndexLive demo

CVE-2025-46331

Medium

Advisory

Published 30 Apr 2025In the index since 8 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.8; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 11; of 17,781 indexed, latest versions
Container images: 8; deployed by those charts
Fix available: 1 of 1; affected package

OpenFGA Authorization Bypass

Carried by container images the latest versions of 11 of 17,781 indexed charts deploy, on 8 images.

Affected package	Affected versions	Fixed in	Images
github.com/openfga/openfgagolang	v1.5.4, v1.6.2, v1.8.6	1.8.11	8

OSV records: GHSA-w222-m46c-mgh6
Also known as: GO-2025-3657

Charts affected

11 by stars

Chart

Latest

Affected images

Radar Score

dbrepodbrepo

1 of 25 See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

52,635

grafanabook-k8sinfra-v2

1 of 1 See more

grafana book-k8sinfra-v2 8.8.2

1 of the 1 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

1,800

kube-prometheus-stackbook-k8sinfra-v2

1 of 6 See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.2.2-security-01	464eac539793	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

6,036

monitoringgaloymoney

1 of 6 See more

monitoring galoymoney 0.12.21

1 of the 6 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

5,295

monitoringgaloymoney2

1 of 6 See more

monitoring galoymoney2 0.12.21

1 of the 6 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

5,295

opentelemetry-demogpg-dev

1 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

49,025

monitoring-stackhelm-charts-alexis-carbillet

1 of 11 See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

9,460

kubecostradar-base

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.8.11

Open the chart page →

9,355

radar-grafanaradar-base

1 of 2 See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.8.11

Open the chart page →

1,667

cost-analyzersoftonic

1 of 6 See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.2	8b37a2f028f1	github.com/openfga/openfga@v1.6.2	1.8.11

Open the chart page →

7,901

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-46331.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	github.com/openfga/openfga@v1.6.2	1.8.11

Open the chart page →

9,381

Container images carrying it

8 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.8.11	3
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.8.11	2
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/openfga/openfga@v1.5.4	1.8.11	1
grafana/grafana :11.2.2-security-01	464eac539793	github.com/openfga/openfga@v1.5.4	1.8.11	1
grafana/grafana :11.5.1	5781759b3d27	github.com/openfga/openfga@v1.6.2	1.8.11	1
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.8.11	1
grafana/grafana :11.5.2	8b37a2f028f1	github.com/openfga/openfga@v1.6.2	1.8.11	1
grafana/grafana :11.3.1	fa801ab6e1ae	github.com/openfga/openfga@v1.5.4	1.8.11	1