StackRadarChart IndexLive demo

CVE-2026-55170

Medium

Advisory

Published 18 Jun 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.003; 27th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 36; of 17,781 indexed, latest versions
Container images: 27; deployed by those charts
Fix available: 1 of 1; affected package

OpenFGA Improper Policy Enforcement

Carried by container images the latest versions of 36 of 17,781 indexed charts deploy, on 27 images.

Affected package	Affected versions	Fixed in	Images
github.com/openfga/openfgagolang	v1.5.4, v1.6.2, v1.8.6, v1.8.12+7 more	1.18.0	27

OSV records: GHSA-cf98-j28v-49v6
Also known as: GO-2026-5322

Charts affected

36 by stars

Chart

Latest

Affected images

Radar Score

signozsignoz

1 of 5 See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
signoz/signoz :v0.141.1	c10fa03e103c	github.com/openfga/openfga@v1.14.1	1.18.0

Open the chart page →

7,568

pulsarapache

1 of 10 See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

9,864

pmmpercona

1 of 1 See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
percona/pmm-server :3.9.1	003f9c25f842	github.com/openfga/openfga@v1.14.2	1.18.0

Open the chart page →

790

coreinstill-ai

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
openfga/openfga :v1.9.2	5e94966c11df	github.com/openfga/openfga@v1.9.2	1.18.0

Open the chart page →

30,816

dbrepodbrepo

1 of 25 See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

52,635

elchi-stackelchi

1 of 10 See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.0	74144189b384	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

15,383

k8s-grafana-stackk8s-grafana-stack

1 of 17 See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.18.0

Open the chart page →

15,418

lgtm-stacklgtm-stack

1 of 8 See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	github.com/openfga/openfga@v1.14.2	1.18.0

Open the chart page →

5,576

opentelemetry-demoopentelemetry-helm

1 of 34 See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	github.com/openfga/openfga@v1.14.2	1.18.0

Open the chart page →

22,420

grafanabook-k8sinfra-v2

1 of 1 See more

grafana book-k8sinfra-v2 8.8.2

1 of the 1 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

1,800

kube-prometheus-stackbook-k8sinfra-v2

1 of 6 See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.2.2-security-01	464eac539793	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

6,036

monitoringcluster-deploy

1 of 11 See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

8,183

dapr-agentsdapr-agents-dev

1 of 31 See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

22,193

dnation-kubernetes-monitoring-stackdnationcloud

1 of 17 See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	github.com/openfga/openfga@v1.14.2	1.18.0

Open the chart page →

21,641

farm-observabilityfarm-observability

1 of 18 See more

farm-observability farm-observability 0.27.2

1 of the 18 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

13,255

monitoringgaloymoney

1 of 6 See more

monitoring galoymoney 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

5,295

monitoringgaloymoney2

1 of 6 See more

monitoring galoymoney2 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

5,295

gnp-stackgnp-stack

1 of 14 See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

7,659

kube-prometheus-stackgpg-dev

1 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

4,288

opentelemetry-demogpg-dev

1 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

49,025

pyroscope-monitoringgrafana

1 of 6 See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

8,188

routergroundcover

1 of 7 See more

router groundcover 1.12.357

1 of the 7 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/openfga/openfga@v1.8.12	1.18.0

Open the chart page →

6,009

monitoring-stackhelm-charts-alexis-carbillet

1 of 11 See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

9,460

kube-prometheus-stackmesosphere

1 of 7 See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	github.com/openfga/openfga@v1.14.2	1.18.0

Open the chart page →

7,398

prometheus-operatormesosphere

1 of 8 See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

11,689

kube-prometheus-stackmesosphere-stable

1 of 7 See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.0.2	b5b59bfc7561	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

10,180

lensoci-ai-incubations

1 of 16 See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.1.1	a1701c218024	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

17,070

vm-standaloneot-container-kit

1 of 6 See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/openfga/openfga@v1.11.3	1.18.0

Open the chart page →

3,378

kubecostradar-base

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.18.0

Open the chart page →

9,355

radar-grafanaradar-base

1 of 2 See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.18.0

Open the chart page →

1,667

grafanasb-helm-charts

1 of 1 See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.2	2ebef928d7e5	github.com/openfga/openfga@v1.8.13	1.18.0

Open the chart page →

1,795

ccx-monitoringseveralnines

1 of 7 See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.18.0

Open the chart page →

7,708

cost-analyzersoftonic

1 of 6 See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.2	8b37a2f028f1	github.com/openfga/openfga@v1.6.2	1.18.0

Open the chart page →

7,901

kube-prometheus-stacksoftonic

1 of 6 See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.2	ba93c9d192e5	github.com/openfga/openfga@v1.11.1	1.18.0

Open the chart page →

4,974

truefoundry-monitoringtruefoundry

1 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.0	70d9599b186c	github.com/openfga/openfga@v1.10.0	1.18.0

Open the chart page →

4,526

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-55170.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	github.com/openfga/openfga@v1.6.2	1.18.0

Open the chart page →

9,381

Container images carrying it

27 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :13.1.0	121a7a9ece6d	github.com/openfga/openfga@v1.14.2	1.18.0	4
grafana/grafana :11.3.0	a0f881232a6f	github.com/openfga/openfga@v1.5.4	1.18.0	3
grafana/grafana :12.3.1	2175aaa91c96	github.com/openfga/openfga@v1.10.0	1.18.0	2
grafana/grafana :12.3.3	9e1e77ade304	github.com/openfga/openfga@v1.11.3	1.18.0	2
grafana/grafana :11.4.0	d8ea37798ccc	github.com/openfga/openfga@v1.5.4	1.18.0	2
grafana/grafana :12.4.1	e932bd6ed0e0	github.com/openfga/openfga@v1.11.3	1.18.0	2
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	github.com/openfga/openfga@v1.5.4	1.18.0	1
grafana/grafana :13.0.1	0f86bada30d6	github.com/openfga/openfga@v1.11.3	1.18.0	1
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	github.com/openfga/openfga@v1.11.3	1.18.0	1
grafana/grafana :12.2.2	2ebef928d7e5	github.com/openfga/openfga@v1.8.13	1.18.0	1
grafana/grafana :12.2.1	35c41e0fd029	github.com/openfga/openfga@v1.8.13	1.18.0	1
grafana/grafana :11.2.2-security-01	464eac539793	github.com/openfga/openfga@v1.5.4	1.18.0	1
grafana/grafana :11.5.1	5781759b3d27	github.com/openfga/openfga@v1.6.2	1.18.0	1
grafana/grafana :11.6.0	62d2b9d20a19	github.com/openfga/openfga@v1.8.6	1.18.0	1
grafana/grafana :12.3.0	70d9599b186c	github.com/openfga/openfga@v1.10.0	1.18.0	1
grafana/grafana :12.2.0	74144189b384	github.com/openfga/openfga@v1.8.13	1.18.0	1
grafana/grafana :11.5.2	8b37a2f028f1	github.com/openfga/openfga@v1.6.2	1.18.0	1
grafana/grafana :12.1.1	a1701c218024	github.com/openfga/openfga@v1.8.13	1.18.0	1
grafana/grafana :12.0.2	b5b59bfc7561	github.com/openfga/openfga@v1.8.13	1.18.0	1
grafana/grafana :12.3.2	ba93c9d192e5	github.com/openfga/openfga@v1.11.1	1.18.0	1
grafana/grafana :11.3.1	fa801ab6e1ae	github.com/openfga/openfga@v1.5.4	1.18.0	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	github.com/openfga/openfga@v1.8.13	1.18.0	1
openfga/openfga :v1.9.2	5e94966c11df	github.com/openfga/openfga@v1.9.2	1.18.0	1
percona/pmm-server :3.9.1	003f9c25f842	github.com/openfga/openfga@v1.14.2	1.18.0	1
signoz/signoz :v0.141.1	c10fa03e103c	github.com/openfga/openfga@v1.14.1	1.18.0	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	github.com/openfga/openfga@v1.8.12	1.18.0	1
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	github.com/openfga/openfga@v1.11.3	1.18.0	1