PT-2026-34222 · Openfga · Openfga

Published 2026-04-21 · Updated 2026-04-25 · CVE-2026-41131

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.14.1

Description In specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This may lead to the reuse of an earlier cached result for a subsequent request. This occurs when the model has relations relying on condition evaluation and caching is enabled.

Recommendations Upgrade to version 1.14.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-706

Related Identifiers

CVE-2026-41131

GHSA-57J5-QWP2-VQP6

Affected Products

Openfga

References · 6

• https://github.com/openfga/openfga/security/advisories/GHSA-57j5-qwp2-vqp6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-57j5-qwp2-vqp6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41131 · Security Note
• https://github.com/openfga/openfga · Note
• https://github.com/openfga/openfga/releases/tag/v1.14.1 · Note
• https://twitter.com/CVEnew/status/2048168401739321748 · Twitter Post