Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: python314Packages.openfga-sdk

Found 1 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-34972
5.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 3 weeks, 1 day ago Activity log
  • Created suggestion 3 weeks, 1 day ago
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

Affected products

openfga
  • ==>= 1.8.0, < 1.14.0

Matching in nixpkgs

pkgs.openfga

High performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

Package maintainers