OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice and user:alice as equivalent, causing two distinct check requests to return the same response. This issue is fixed in 1.18.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being
    used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple,
    changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice
    and user:alice as equivalent, causing two distinct check requests to return the same response. This issue
    is fixed in 1.18.0. (CVE-2026-55170)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being     used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple,     changelog, and authorization_model identifier columns can compare case-distinct values such as user:Alice     and user:alice as equivalent, causing two distinct check requests to return the same response. This issue     is fixed in 1.18.0. (CVE-2026-55170)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463503	Echo: grafana-12.3-fips: security update to 12.3.11+e4	Tenable Cloud Security	Echo Local Security Checks	Local	low
463503	Echo: grafana-12.3-fips: security update to 12.3.11+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
326316	Linux Distros Unpatched Vulnerability : CVE-2026-55170	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-55170

low

Tenable Plugins

low

low

low