PT-2026-34222 · Openfga · Openfga

CVE-2026-41131 · Published 2026-04-21 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.14.1

Description In specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This may lead to the reuse of an earlier cached result for a subsequent request. This occurs when the model has relations relying on condition evaluation and caching is enabled.

Recommendations Upgrade to version 1.14.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-706

CWE-863

Related Identifiers

CVE-2026-41131

GHSA-57J5-QWP2-VQP6

GO-2026-5136

OPENSUSE-SU-2026:21483-1

Affected Products

Openfga

References · 1744

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41131.json · Exploit
• https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41131 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57j5-qwp2-vqp6 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41131 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/openfga/openfga/releases/tag/v1.14.1 · Note
• https://github.com/openfga/openfga · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note