UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-108167
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Cve id
- CVE-2026-108167
- First seen by Signal
- 2026-11-10T23:31:41+00:00
- Retrieved at
- 2026-11-10T23:34:23+00:00
- Published at
- 2026-11-10T21:17:53.883
- Last modified
- 2026-11-10T22:17:44.923
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph