5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34972

CVE-2026-34972: OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34972

CVE-2026-34972:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openfga/openfga	go	>= 1.8.0, <= 1.13.1	1.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cache key collision issue within the BatchCheck functionality of OpenFGA. When multiple checks for the same user, object, and relation are sent in a single BatchCheck request with slightly different context values, the caching mechanism could generate the same cache key for them. This is because the storage.writeValue function, which serializes the context for the cache key, did not properly handle cases like a single list item containing a comma versus multiple list items. This could lead to incorrect authorization decisions as a cached (and potentially incorrect) decision for one check could be returned for another.

The patch addresses this by modifying storage.writeValue to prepend the length of string values during serialization. This ensures that different context structures will produce unique cache keys, preventing collisions. The commands.generateCacheKeyFromCheck function is directly responsible for creating the cache key and utilizes the flawed writeValue function. The server.BatchCheck function is the public API endpoint that serves as the entry point for triggering this vulnerability.

Vulnerable functions

storage.writeValue

pkg/storage/cache.go

This function is responsible for serializing context data into a string for cache key generation. The vulnerability lies in the fact that it did not properly distinguish between different list structures in the context, leading to cache key collisions. The patch fixes this by prepending the length of string values, ensuring that different structures produce different keys.

commands.generateCacheKeyFromCheck

pkg/server/commands/batch_check_command.go

This function uses the vulnerable `writeValue` function to generate a cache key from a check item, including its context. The new test added in the patch explicitly demonstrates the cache key collision scenario that this vulnerability addresses, confirming this function's role in the vulnerable code path.

server.BatchCheck

pkg/server/server.go

This is the main user-facing API endpoint that is affected by the vulnerability. When a user sends a `BatchCheck` request with specific context data, this function initiates the process that leads to the vulnerable cache key generation logic. A runtime profiler would show this function as the entry point for an exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.