StackRadarChart IndexLive demo

CVE-2026-34972

Medium

Advisory

Published 7 Apr 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.0; base score, highest
EPSS: 0.002; 11th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 17; deployed by those charts
Fix available: 1 of 1; affected package

OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 17 images.

Affected package	Affected versions	Fixed in	Images
github.com/openfga/openfgagolang	v1.8.6, v1.8.12, v1.8.13, v1.9.2+3 more	1.14.0	17

OSV records: GHSA-jwvj-g8pc-cx45
Also known as: GO-2026-5483

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

pulsarapache

1 of 10 See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

9,864

coreinstill-ai

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
openfga/openfga :v1.9.2	5e94966c11df	github.com/openfga/openfga@v1.9.2	1.14.0

Open the chart page →

30,816

elchi-stackelchi

1 of 10 See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.0	74144189b384	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

15,383

k8s-grafana-stackk8s-grafana-stack

1 of 17 See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.14.0

Open the chart page →

15,418

monitoringcluster-deploy

1 of 11 See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

8,183

dapr-agentsdapr-agents-dev

1 of 31 See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

22,193

farm-observabilityfarm-observability

1 of 18 See more

farm-observability farm-observability 0.27.2

1 of the 18 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

13,255

gnp-stackgnp-stack

1 of 14 See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

7,659

kube-prometheus-stackgpg-dev

1 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

4,288

pyroscope-monitoringgrafana

1 of 6 See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

8,188

routergroundcover

1 of 7 See more

router groundcover 1.12.357

1 of the 7 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/openfga/openfga@v1.8.12	1.14.0

Open the chart page →

6,009

prometheus-operatormesosphere

1 of 8 See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

11,689

kube-prometheus-stackmesosphere-stable

1 of 7 See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.0.2	b5b59bfc7561	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

10,180

lensoci-ai-incubations

1 of 16 See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.1.1	a1701c218024	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

17,070

vm-standaloneot-container-kit

1 of 6 See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/openfga/openfga@v1.11.3	1.14.0

Open the chart page →

3,378

radar-grafanaradar-base

1 of 2 See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.14.0

Open the chart page →

1,667

grafanasb-helm-charts

1 of 1 See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.2	2ebef928d7e5	github.com/openfga/openfga@v1.8.13	1.14.0

Open the chart page →

1,795

ccx-monitoringseveralnines

1 of 7 See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.14.0

Open the chart page →

7,708

kube-prometheus-stacksoftonic

1 of 6 See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.2	ba93c9d192e5	github.com/openfga/openfga@v1.11.1	1.14.0

Open the chart page →

4,974

truefoundry-monitoringtruefoundry

1 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-34972.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.0	70d9599b186c	github.com/openfga/openfga@v1.10.0	1.14.0

Open the chart page →

4,526

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.14.0	2
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.14.0	2
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.14.0	2
grafana/grafana :13.0.1	0f86bada30d6	github.com/openfga/openfga@v1.11.3	1.14.0	1
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	github.com/openfga/openfga@v1.11.3	1.14.0	1
grafana/grafana :12.2.2	2ebef928d7e5	github.com/openfga/openfga@v1.8.13	1.14.0	1
grafana/grafana :12.2.1	35c41e0fd029	github.com/openfga/openfga@v1.8.13	1.14.0	1
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.14.0	1
grafana/grafana :12.3.0	70d9599b186c	github.com/openfga/openfga@v1.10.0	1.14.0	1
grafana/grafana :12.2.0	74144189b384	github.com/openfga/openfga@v1.8.13	1.14.0	1
grafana/grafana :12.1.1	a1701c218024	github.com/openfga/openfga@v1.8.13	1.14.0	1
grafana/grafana :12.0.2	b5b59bfc7561	github.com/openfga/openfga@v1.8.13	1.14.0	1
grafana/grafana :12.3.2	ba93c9d192e5	github.com/openfga/openfga@v1.11.1	1.14.0	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/openfga/openfga@v1.8.13	1.14.0	1
openfga/openfga :v1.9.2	5e94966c11df	github.com/openfga/openfga@v1.9.2	1.14.0	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/openfga/openfga@v1.8.12	1.14.0	1
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/openfga/openfga@v1.11.3	1.14.0	1