CVE-2026-41131
Cache Key Collision Vulnerability in OpenFGA Authorization Engine
Publication date: 2026-04-22
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openfga | openfga | to 1.14.1 (exc) |
| openfga | helm_charts | to 0.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects OpenFGA, an authorization and permission engine. Before version 1.14.1, when models used conditions with caching enabled, two different check requests could produce the same cache key. This means OpenFGA might reuse a cached result from an earlier request for a different subsequent request, potentially leading to incorrect authorization decisions.
The issue occurs only if the model has relations that rely on condition evaluation and caching is enabled by the user. The problem was fixed in OpenFGA version 1.14.1.
How can this vulnerability impact me? :
This vulnerability can impact you by causing OpenFGA to return incorrect authorization results due to cache reuse. Specifically, a permission check might incorrectly allow or deny access because it used a cached response from a different request.
Such incorrect authorization decisions can lead to unauthorized access or denial of legitimate access, potentially compromising the security and functionality of applications relying on OpenFGA for permission management.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade OpenFGA to version 1.14.1 or later, as this version contains the fix addressing the caching issue.
Additionally, review your models to identify if they use relations relying on condition evaluation with caching enabled, as these are the preconditions for the vulnerability.