Caching Vulnerability in OpenFGA Authorization Engine by OpenFGA

CVE-2026-33729

What is CVE-2026-33729?

An issue in the OpenFGA authorization engine allows for the potential reuse of cached results across different check requests when caching is enabled and certain conditions are met. This may lead to incorrect authorization decisions, especially in models that rely on condition evaluations. The problem arises when two distinct requests generate the same cache key, leading to potential security concerns. OpenFGA version 1.13.1 has been released to address this vulnerability and enhance system security.

References