CVE-2026-61709 is a vulnerability in OpenFGA's ListUsers API where the API may return users that should have been excluded by a but-not clause when an intersection uses a type-bound public wildcard. This can lead to unauthorized access in applications relying on ListUsers for access control. Red Hat does not ship OpenFGA standalone; it is bundled in Grafana's experimental Zanzana engine, which is embedded in Red Hat Ceph Storage dashboards, Red Hat Advanced Cluster Management, Multicluster Global Hub, and the RHEL grafana package. Zanzana is disabled by default and Grafana's main authorization uses different APIs (Check and ListObjects), so the vulnerable API is not the enforcement path in these products. The vulnerability is fixed in OpenFGA version 1.18.1. Red Hat provides updated RPMs for grafana12.4 including this fix.

Applications relying on the vulnerable ListUsers API for access control decisions might inadvertently grant unauthorized access to resources or sensitive information due to incorrect user exclusion logic. However, since the vulnerable API is part of an experimental engine (Zanzana) that is disabled by default and not used in Grafana's main authorization path, the practical impact on Red Hat products is limited unless Zanzana is explicitly enabled.

No product-side mitigation is required while Zanzana remains disabled, which is the default setting. If Zanzana has been enabled, do not use ListUsers results for access control decisions; instead, use the Check API for each user and object. Apply the update to OpenFGA version 1.18.1 or later when it becomes available in Grafana. Red Hat has released updated grafana12.4 RPMs containing the fix. Refer to Red Hat advisory RHSA-2026:68821 for update instructions.