StackRadar

CVE-2026-48096

Medium

Advisory

Published 11 Jun 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.0
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
36
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
1 of 1
affected package

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

Carried by container images the latest versions of 36 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
github.com/openfga/openfgagolangv1.5.4, v1.6.2, v1.8.6, v1.8.12+7 more1.16.027
OSV records
GHSA-8396-jffm-qx4w
Also known as
GO-2026-5239

Charts affected

36 by stars
ChartLatestAffected imagesRadar Score
signozsignoz0.141.11 of 5See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
signoz/signoz:v0.141.1c10fa03e103c
github.com/openfga/openfga@v1.14.1
1.16.0

Open the chart page →

7,568
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

9,864
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
github.com/openfga/openfga@v1.14.2
1.16.0

Open the chart page →

790
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
openfga/openfga:v1.9.25e94966c11df
github.com/openfga/openfga@v1.9.2
1.16.0

Open the chart page →

30,816
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

52,635
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.2.074144189b384
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

15,383
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.16.0

Open the chart page →

15,418
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.16.0

Open the chart page →

5,576
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.16.0

Open the chart page →

22,420
grafanabook-k8sinfra-v28.8.21 of 1See more

grafana book-k8sinfra-v2 8.8.2

1 of the 1 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

1,800
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.2.2-security-01464eac539793
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

6,036
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

8,183
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

22,193
dnation-kubernetes-monitoring-stackdnationcloud4.0.21 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.16.0

Open the chart page →

21,641
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.21 of 18See more

farm-observability farm-observability 0.27.2

1 of the 18 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

13,255
monitoringgaloymoney0.12.211 of 6See more

monitoring galoymoney 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

5,295
monitoringgaloymoney20.12.211 of 6See more

monitoring galoymoney2 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

5,295
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

7,659
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

4,288
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.3.1fa801ab6e1ae
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

49,025
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

8,188
routergroundcover1.12.3571 of 7See more

router groundcover 1.12.357

1 of the 7 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/openfga/openfga@v1.8.12
1.16.0

Open the chart page →

6,009
monitoring-stackhelm-charts-alexis-carbillet0.1.01 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

9,460
kube-prometheus-stackmesosphere87.16.01 of 7See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.16.0

Open the chart page →

7,398
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

11,689
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

10,180
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

17,070
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/openfga/openfga@v1.11.3
1.16.0

Open the chart page →

3,378
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.16.0

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/openfga/openfga@v1.8.6
1.16.0

Open the chart page →

1,667
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/openfga/openfga@v1.8.13
1.16.0

Open the chart page →

1,795
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.16.0

Open the chart page →

7,708
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/openfga/openfga@v1.6.2
1.16.0

Open the chart page →

7,901
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/openfga/openfga@v1.11.1
1.16.0

Open the chart page →

4,974
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/openfga/openfga@v1.10.0
1.16.0

Open the chart page →

4,526
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-48096.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/openfga/openfga@v1.6.2
1.16.0

Open the chart page →

9,381

Container images carrying it

27 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.16.0
4
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.16.0
3
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.16.0
2
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.16.0
2
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.16.0
2
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.16.0
2
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/openfga/openfga@v1.5.4
1.16.0
1
grafana/grafana:13.0.10f86bada30d6
github.com/openfga/openfga@v1.11.3
1.16.0
1
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/openfga/openfga@v1.11.3
1.16.0
1
grafana/grafana:12.2.22ebef928d7e5
github.com/openfga/openfga@v1.8.13
1.16.0
1
grafana/grafana:12.2.135c41e0fd029
github.com/openfga/openfga@v1.8.13
1.16.0
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/openfga/openfga@v1.5.4
1.16.0
1
grafana/grafana:11.5.15781759b3d27
github.com/openfga/openfga@v1.6.2
1.16.0
1
grafana/grafana:11.6.062d2b9d20a19
github.com/openfga/openfga@v1.8.6
1.16.0
1
grafana/grafana:12.3.070d9599b186c
github.com/openfga/openfga@v1.10.0
1.16.0
1
grafana/grafana:12.2.074144189b384
github.com/openfga/openfga@v1.8.13
1.16.0
1
grafana/grafana:11.5.28b37a2f028f1
github.com/openfga/openfga@v1.6.2
1.16.0
1
grafana/grafana:12.1.1a1701c218024
github.com/openfga/openfga@v1.8.13
1.16.0
1
grafana/grafana:12.0.2b5b59bfc7561
github.com/openfga/openfga@v1.8.13
1.16.0
1
grafana/grafana:12.3.2ba93c9d192e5
github.com/openfga/openfga@v1.11.1
1.16.0
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/openfga/openfga@v1.5.4
1.16.0
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/openfga/openfga@v1.8.13
1.16.0
1
openfga/openfga:v1.9.25e94966c11df
github.com/openfga/openfga@v1.9.2
1.16.0
1
percona/pmm-server:3.9.1003f9c25f842
github.com/openfga/openfga@v1.14.2
1.16.0
1
signoz/signoz:v0.141.1c10fa03e103c
github.com/openfga/openfga@v1.14.1
1.16.0
1
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/openfga/openfga@v1.8.12
1.16.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/openfga/openfga@v1.11.3
1.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.