CVE-2026-34972 OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

What is CVE-2026-34972?

CVE-2026-34972 is a medium-severity vulnerability in openfga, published on 6 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-34972?

3 open source packages ship an affected version, including github.com/openfga/openfga. It affects 2 products.

Products include Openfga Helm Charts, Openfga Openfga.

How do I fix CVE-2026-34972?

Upgrade github.com/openfga/openfga to 1.14.0 or later.

Is CVE-2026-34972 being exploited?

There is no known exploitation of CVE-2026-34972 in the wild and no public exploit code.

Other vulnerabilities in openfga

• CVE-2026-55689 OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset Medium 6.8
• CVE-2026-24851 OpenFGA Improper Policy Enforcement Medium 5.8
• CVE-2025-64751 OpenFGA Improper Policy Enforcement Medium 5.8
• CVE-2025-55213 OpenFGA Authorization Bypass (Check) Medium 5.8
• CVE-2025-48371 OpenFGA Authorization Bypass Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-ED95969, CLEANSTART-2026-SX02266, GHSA-jwvj-g8pc-cx45, GO-2026-5483, MINI-2q75-9w6m-gvjw, MINI-668m-4jv8-q77w and 16 more.