| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openfga/openfga | < 1.16.0 | 1.16.0 |
| helm charts | < 0.3.5 | 0.3.5 |
| openfga | < 1.16.0 | 1.16.0 |
In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.
This applies if the following preconditions are present:
Upgrade to version 1.16.0 or greater.
OpenFGA would like to thank @j4xT for the discovery and the detailed report.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free