OpenFGA
v1.14.1Securityv1.14.1 patches a host-header poisoning vulnerability in AuthZEN discovery and removes a vulnerable Docker dependency, plus minor ListObjects performance gains.
securityPatch the AuthZEN host-header poisoning vulnerability now
The AuthZEN well-known discovery endpoint was returning URLs built from the request's Host header. An attacker could poison this to redirect clients to a malicious endpoint. If you expose the AuthZEN discovery metadata publicly, upgrade to v1.14.1 immediately. No config change needed — the fix is automatic once upgraded, as long as authzen.baseURL is correctly set in your server config.
securityAudit your image builds if you ship the OpenFGA test binary
The github.com/docker/docker package carries known CVEs and was only used in test code. Production builds are unaffected, but if your pipeline somehow includes test binaries or vendor directories in container images, verify they no longer include the vulnerable package after upgrading.
enhancementSet an explicit server shutdown timeout for Kubernetes workloads
The new shutdown timeout config option lets you control how long OpenFGA waits to drain in-flight requests before exiting. Without this, abrupt shutdowns can cause request errors during pod restarts. Set this to slightly less than your Kubernetes terminationGracePeriodSeconds to ensure clean handoff.
Key changes (5)
- Security fix: AuthZEN discovery metadata now uses configured baseURL instead of request-supplied host headers, closing a host-header poisoning attack vector
- Removed vulnerable github.com/docker/docker test dependency, replaced with Moby client & API
- Configurable server shutdown timeout added — useful for graceful drain in Kubernetes environments
- ListObjects heap allocations reduced, yielding minor but real latency improvements
- Cache key generation faster by dropping fmt usage and extending control-character sanitization to tuples, conditions, and context