CVE-2026-40293

OVERVIEW: OpenFGA versions 0.1.4 through 1.13.1 contain a credential exposure vulnerability in which the preshared API key is inadvertently disclosed in the HTML response of the /playground endpoint when preshared-key authentication is configured. This development and debugging feature is enabled by default and requires no authentication, creating an information disclosure risk if the endpoint is exposed beyond localhost or trusted networks. SEVERITY: The vulnerability carries a CVSS score of 6.5 (Medium) with a network-based attack vector requiring no privileges or user interaction, indicating a low-complexity attack scenario. The exposure is limited to confidentiality and integrity impacts without affecting availability. The EPSS score of 0.00067 indicates this represents a low-probability exploitation risk relative to all known CVEs, and the FAUCET Risk Score of 35.0/100 reflects moderate concern. EXPLOITATION STATUS: There is no evidence of active exploitation, and the vulnerability is not listed on the Known Exploited Vulnerabilities catalog. Community attention remains low, and no public exploit code is widely available. Remediation is straightforward through upgrade to version 1.14.0 or by disabling the playground feature. Organizations should prioritize this only if OpenFGA instances are running with preshared-key authentication and the playground endpoint is exposed to untrusted networks.