StackRadar

CVE-2026-61709

Medium

Advisory

Published 16 Sept 2026In the index since 17 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
47
of 17,797 indexed, latest versions
Container images
31
deployed by those charts
Fix available
1 of 1
affected package

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user

Carried by container images the latest versions of 47 of 17,797 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
github.com/openfga/openfgagolangv1.5.4, v1.6.2, v1.8.6, v1.8.12+8 more1.18.131
OSV records
GHSA-g3pg-frfm-pr2m

Charts affected

47 by stars
ChartLatestAffected imagesRadar Score
victoria-metrics-k8s-stackvictoriametricsVerified publisher0.92.11 of 7See more

victoria-metrics-k8s-stack victoriametrics 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

1,915
signozsignoz0.142.01 of 5See more

signoz signoz 0.142.0

1 of the 5 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
signoz/signoz:v0.142.0041de69ac78a
github.com/openfga/openfga@v1.14.1
1.18.1

Open the chart page →

7,566
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

9,885
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
github.com/openfga/openfga@v1.14.2
1.18.1

Open the chart page →

802
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
openfga/openfga:v1.9.25e94966c11df
github.com/openfga/openfga@v1.9.2
1.18.1

Open the chart page →

31,187
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
openfga/openfga:v1.18.036097b960f66
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

15,048
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

53,282
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.2.074144189b384
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

15,567
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.18.1

Open the chart page →

15,539
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.18.1

Open the chart page →

5,679
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.41.21 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.2

1 of the 34 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.18.1

Open the chart page →

23,064
grafanabook-k8sinfra-v28.8.21 of 1See more

grafana book-k8sinfra-v2 8.8.2

1 of the 1 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

1,813
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.2.2-security-01464eac539793
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

6,049
catalyst-agentscatalyst-agents0.1.331 of 18See more

catalyst-agents catalyst-agents 0.1.33

1 of the 18 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.3ab5cb380e3ff
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

17,127
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

8,217
loki-stackcommon-chartsVerified publisher1.0.31 of 12See more

loki-stack common-charts 1.0.3

1 of the 12 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

5,425
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

22,370
dnation-kubernetes-monitoring-stackdnationcloud4.0.21 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.18.1

Open the chart page →

21,767
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.21 of 18See more

farm-observability farm-observability 0.27.2

1 of the 18 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

13,428
monitoringgaloymoney0.12.211 of 6See more

monitoring galoymoney 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

5,316
monitoringgaloymoney20.12.211 of 6See more

monitoring galoymoney2 0.12.21

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

5,316
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

7,689
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

4,302
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.3.1fa801ab6e1ae
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

49,501
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

8,281
routergroundcover1.12.3751See more

router groundcover 1.12.375

1 container image this version deploys carries CVE-2026-61709.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/openfga/openfga@v1.8.12
1.18.1

Open the chart page →

monitoring-stackhelm-charts-alexis-carbillet0.1.01 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

10,649
kube-prometheus-stackmesosphere87.16.01 of 7See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.18.1

Open the chart page →

7,457
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

11,703
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

10,239
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

17,161
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/openfga/openfga@v1.11.3
1.18.1

Open the chart page →

3,449
grafanaquench-grafanaVerified publisher0.0.121 of 1See more

grafana quench-grafana 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

131
harbor-observabilityquench-harbor-observabilityVerified publisher0.0.101 of 2See more

harbor-observability quench-harbor-observability 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

200
lgtm-stackquench-lgtm-stackVerified publisher0.0.191 of 9See more

lgtm-stack quench-lgtm-stack 0.0.19

1 of the 9 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

408
logging-stackquench-logging-stackVerified publisher0.0.121 of 3See more

logging-stack quench-logging-stack 0.0.12

1 of the 3 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

208
observability-stackquench-observability-stackVerified publisher0.0.141 of 5See more

observability-stack quench-observability-stack 0.0.14

1 of the 5 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

292
tracing-stackquench-tracing-stackVerified publisher0.0.91 of 3See more

tracing-stack quench-tracing-stack 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinned3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

309
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.18.1

Open the chart page →

9,418
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/openfga/openfga@v1.8.6
1.18.1

Open the chart page →

1,679
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/openfga/openfga@v1.8.13
1.18.1

Open the chart page →

1,809
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.18.1

Open the chart page →

7,718
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/openfga/openfga@v1.6.2
1.18.1

Open the chart page →

7,962
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/openfga/openfga@v1.11.1
1.18.1

Open the chart page →

4,988
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/openfga/openfga@v1.10.0
1.18.1

Open the chart page →

4,549
victoria-metrics-k8s-stackwenerme0.92.11 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

1 of the 7 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/openfga/openfga@v1.18.0
1.18.1

Open the chart page →

1,915
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-61709.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/openfga/openfga@v1.6.2
1.18.1

Open the chart page →

9,401

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/quenchworks/images/grafana3ccc56791c8a
github.com/openfga/openfga@v1.18.0
1.18.1
6
grafana/grafana:13.1.0121a7a9ece6d
github.com/openfga/openfga@v1.14.2
1.18.1
4
grafana/grafana:13.1.17cb8c64c4d57
github.com/openfga/openfga@v1.18.0
1.18.1
3
grafana/grafana:11.3.0a0f881232a6f
github.com/openfga/openfga@v1.5.4
1.18.1
3
grafana/grafana:12.3.12175aaa91c96
github.com/openfga/openfga@v1.10.0
1.18.1
2
grafana/grafana:12.3.39e1e77ade304
github.com/openfga/openfga@v1.11.3
1.18.1
2
grafana/grafana:11.4.0d8ea37798ccc
github.com/openfga/openfga@v1.5.4
1.18.1
2
grafana/grafana:12.4.1e932bd6ed0e0
github.com/openfga/openfga@v1.11.3
1.18.1
2
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
github.com/openfga/openfga@v1.5.4
1.18.1
1
grafana/grafana:13.0.10f86bada30d6
github.com/openfga/openfga@v1.11.3
1.18.1
1
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/openfga/openfga@v1.11.3
1.18.1
1
grafana/grafana:12.2.22ebef928d7e5
github.com/openfga/openfga@v1.8.13
1.18.1
1
grafana/grafana:12.2.135c41e0fd029
github.com/openfga/openfga@v1.8.13
1.18.1
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/openfga/openfga@v1.5.4
1.18.1
1
grafana/grafana:11.5.15781759b3d27
github.com/openfga/openfga@v1.6.2
1.18.1
1
grafana/grafana:11.6.062d2b9d20a19
github.com/openfga/openfga@v1.8.6
1.18.1
1
grafana/grafana:12.3.070d9599b186c
github.com/openfga/openfga@v1.10.0
1.18.1
1
grafana/grafana:12.2.074144189b384
github.com/openfga/openfga@v1.8.13
1.18.1
1
grafana/grafana:11.5.28b37a2f028f1
github.com/openfga/openfga@v1.6.2
1.18.1
1
grafana/grafana:12.1.1a1701c218024
github.com/openfga/openfga@v1.8.13
1.18.1
1
grafana/grafana:13.1.3ab5cb380e3ff
github.com/openfga/openfga@v1.18.0
1.18.1
1
grafana/grafana:12.0.2b5b59bfc7561
github.com/openfga/openfga@v1.8.13
1.18.1
1
grafana/grafana:12.3.2ba93c9d192e5
github.com/openfga/openfga@v1.11.1
1.18.1
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/openfga/openfga@v1.5.4
1.18.1
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/openfga/openfga@v1.8.13
1.18.1
1
openfga/openfga:v1.18.036097b960f66
github.com/openfga/openfga@v1.18.0
1.18.1
1
openfga/openfga:v1.9.25e94966c11df
github.com/openfga/openfga@v1.9.2
1.18.1
1
percona/pmm-server:3.9.1003f9c25f842
github.com/openfga/openfga@v1.14.2
1.18.1
1
signoz/signoz:v0.142.0041de69ac78a
github.com/openfga/openfga@v1.14.1
1.18.1
1
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/openfga/openfga@v1.8.12
1.18.1
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/openfga/openfga@v1.11.3
1.18.1
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.