PT-2026-28515 · Openfga · Openfga

Amemoyoif · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-33729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.13.1

Description OpenFGA is a high-performance and flexible authorization/permission engine. Under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations that depend on condition evaluation and caching is enabled.

Recommendations Upgrade to OpenFGA version 1.13.1.

Exploit

Fix

Insufficient Verification of Data Authenticity

RCE

Weakness Enumeration

CWE-345

CWE-1289

CWE-20

Related Identifiers

CVE-2026-33729

GHSA-H6C8-CWW8-35HF

GO-2026-4857

SUSE-SU-2026:1135-1

Affected Products

Openfga

References · 151

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33729.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf · Vendor Advisory
• https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8 · Patch
• https://osv.dev/vulnerability/CVE-2026-33729 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4857 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6c8-cww8-35hf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33729 · Security Note
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/releases/tag/v1.13.1 · Note
• https://suse.com/security/cve/CVE-2026-33525 · Note
• https://suse.com/security/cve/CVE-2026-25780 · Note
• https://suse.com/security/cve/CVE-2026-22545 · Note
• https://suse.com/security/cve/CVE-2026-33679 · Note
• https://suse.com/security/cve/CVE-2026-32771 · Note