5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41131

CVE-2026-41131: OpenFGA has Improper Policy Enforcement

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.14.1, in specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key. This could result in OpenFGA reusing an earlier cached result for a subsequent request. The preconditions for vulnerability are the model having relations which rely on condition evaluation and the user having caching enabled. OpenFGA v1.14.1 contains a fix.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41131

CVE-2026-41131:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openfga/openfga	go	< 1.14.1	1.14.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in OpenFGA (CVE-2026-41131) is a case of improper policy enforcement due to a cache key collision. When caching is enabled, specially crafted check requests with control characters in the condition name or context could generate the same cache key as a different, legitimate request. This could lead to the wrong authorization result being returned from the cache.

The root cause was improper input sanitization. Instead of rejecting inputs with control characters, the cache key generation logic attempted to sanitize them by replacing them with a placeholder. This created the possibility for different inputs to be normalized to the same cache key.

The fix addresses this issue at multiple levels:

Input Validation: Stricter validation was added at the beginning of the request lifecycle. The validateCheckRequest and validateCondition functions were updated to reject any requests containing control characters in the context or condition names.
Cache Key Generation: The cache key generation logic in writeValue was changed to stop sanitizing inputs. Instead, it now assumes that inputs have been validated and will error if it encounters any forbidden characters, preventing the creation of ambiguous cache keys.

By rejecting invalid inputs early and removing the flawed sanitization, the patch ensures that each unique check request generates a unique cache key, thus resolving the vulnerability.

Vulnerable functions

github.com/openfga/openfga/pkg/server/commands.CheckQuery.Execute

pkg/server/commands/check_command.go

The `Execute` method of `CheckQuery` is the entry point for a check operation. Before the patch, it called `validateCheckRequest` without passing the request context. This meant that the context, which can be controlled by the user, was not validated for malicious content before being used in cache key generation, making the application vulnerable.

github.com/openfga/openfga/pkg/server/commands.validateCheckRequest

pkg/server/commands/check_command.go

This function is responsible for validating the parameters of a check request. The vulnerability lies in the fact that this function did not validate the request context (`requestCtx`). The patch added a call to `validation.ValidateStruct` to ensure that the context does not contain any forbidden characters that could be used to manipulate the cache key.

github.com/openfga/openfga/internal/validation.validateCondition

internal/validation/validation.go

This function validates a tuple with a condition. It was vulnerable because it did not check the condition name for forbidden characters. An attacker could have used control characters in the condition name to cause a cache key collision. The patch adds a check using `utils.ContainsForbiddenChars`.

github.com/openfga/openfga/pkg/storage.writeValue

pkg/storage/cache.go

This function is responsible for writing parts of the cache key. The original implementation was vulnerable because it attempted to sanitize string values by replacing control characters with '?'. This could lead to different strings producing the same sanitized output, resulting in a cache key collision. The patch removes this sanitization logic and instead relies on upstream validation to reject invalid characters, making the process safer.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.