OpenFGA has an Authorization Bypass through cached keys
cve-program · CVE-2026-33729
PublishedOpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations which rely on condition evaluation andncaching is enabled. OpenFGA v1.13.1 contains a patch.
Read the publisher's advisoryeuvd · EUVD-2026-16507
PublishedOpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations which rely on condition evaluation andncaching is enabled. OpenFGA v1.13.1 contains a patch.
Read the publisher's advisorynvd · CVE-2026-33729
PublishedOpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations which rely on condition evaluation andncaching is enabled. OpenFGA v1.13.1 contains a patch.
Read the publisher's advisoryosv · GHSA-h6c8-cww8-35hf
Published### Description In OpenFGA, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. ### Am I Affected? Users are affected if the following preconditions are met: 1. The model has relations which rely on condition evaluation. 1. Caching is enabled. ### Fix Upgrade to OpenFGA v1.13.1. ### Acknowledgement OpenFGA would like to thank @Amemoyoi for the discovery and responsible disclosure.
Read the publisher's advisoryosv · GO-2026-4857
PublishedOpenFGA has an Authorization Bypass through cached keys in github.com/openfga/openfga
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-33729 · CVE overview and exploitation status
cve-program · CVE-2026-33729
- https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
- https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
- https://github.com/openfga/openfga/releases/tag/v1.13.1
euvd · EUVD-2026-16507
- https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
- https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
- https://github.com/openfga/openfga/releases/tag/v1.13.1
nvd · CVE-2026-33729
- https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
- https://github.com/openfga/openfga/releases/tag/v1.13.1
- https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
osv · GHSA-h6c8-cww8-35hf
- https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf
- https://nvd.nist.gov/vuln/detail/CVE-2026-33729
- https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8
- https://github.com/openfga/openfga
- https://github.com/openfga/openfga/releases/tag/v1.13.1
osv · GO-2026-4857
Related changes
Linked by CVE identifierNo related changes are available here.