PT-2026-28515 · Openfga · Openfga

Amemoyoif · Publicado 2026-03-26 · Atualizado 2026-03-27 · CVE-2026-33729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.13.1

Description OpenFGA is a high-performance and flexible authorization/permission engine. Under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations that depend on condition evaluation and caching is enabled.

Recommendations Upgrade to OpenFGA version 1.13.1.

Exploit

Correção

Insufficient Verification of Data Authenticity

RCE

Enumeração de Fraquezas

CWE-345

CWE-1289

CWE-20

Identificadores relacionados

CVE-2026-33729

GHSA-H6C8-CWW8-35HF

GO-2026-4857

SUSE-SU-2026:1135-1

Produtos afetados

Openfga

Referências · 151

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33729.json · Exploit
• https://github.com/openfga/openfga · Nota
• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf · Aviso do Fabricante
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8 · Correção
• https://github.com/openfga/openfga/releases/tag/v1.13.1 · Nota
• https://suse.com/security/cve/CVE-2026-33525 · Nota
• https://suse.com/security/cve/CVE-2026-25780 · Nota
• https://suse.com/security/cve/CVE-2026-22545 · Nota
• https://suse.com/security/cve/CVE-2026-33679 · Nota
• https://suse.com/security/cve/CVE-2026-32771 · Nota
• https://suse.com/security/cve/CVE-2026-33282 · Nota
• https://suse.com/security/cve/CVE-2026-32254 · Nota
• https://suse.com/security/cve/CVE-2026-2461 · Nota
• https://suse.com/security/cve/CVE-2026-32879 · Nota
• https://suse.com/security/cve/CVE-2026-33203 · Nota