Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: OpenFGAClear ×

OpenFGAv1.18.0SecurityJun 17, 2026

CHECK 3View full analysis

v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.

Check if affected (3)

securitymediumMySQL schema migrations 008
Applies if you use the MySQL backend.
v1.18.0 ships schema migrations 008 for the MySQL backend, and they require a maintenance window. The release note points to the [operator runbook](https://github.com/openfga/openfga/blob/main/assets/migrations/mysql/collation_migrations.md) before upgrading and associates the migrations with CVE-2026-55170 and CVE-2026-55689.
securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
The release uses crypto/subtle.ConstantTimeCompare for preshared key authentication in v1.18.0. This closes a timing side-channel caused by the prior map lookup revealing information about valid key bytes.
securityRequired OIDC issuer and audience configuration
Applies if authn.method is set to oidc.
v1.18.0 requires both authn.oidc.issuer and authn.oidc.audience to be set when authn.method is oidc.

Source ↗

OpenFGAv1.14.1SecurityApr 10, 2026

CHECK 2OTHER 3View full analysis

A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.

Check if affected (2)

securityAuthZEN discovery metadata endpoint URLs
Applies if authzen.baseURL is configured.
AuthZEN discovery metadata now publishes endpoint URLs from the configured authzen.baseURL instead of request-supplied host headers, preventing host-header poisoning.
securityThe github.com/docker/docker test dependency, replaced with Moby
Applies if tests run.
The vulnerable github.com/docker/docker package, used only in tests, was removed and replaced with Moby (client & api).

Source ↗

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
The Playground now supports only the none authentication method. preshared key authentication is no longer supported.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. The Playground server address is specified with --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead, using the full host:port address.

Source ↗

OpenFGAv1.13.1SecurityMar 24, 2026

CHECK 1View full analysis

A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.

Check if affected (1)

securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed
Applies if Check requests use conditions and caching is enabled.
The fix addresses CVE-2026-33729 and GHSA-h6c8-cww8-35hf in Check requests with conditions and caching enabled, which could return incorrect cached results. This correction ships in this release.

Source ↗

OpenFGAv1.12.0SecurityMar 13, 2026

ACTION 2CHECK 1OTHER 7View full analysis

A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.

Action needed (2)

securityhighGo toolchain version 1.25.8
The Go toolchain is updated to version 1.25.8 to address standard library vulnerabilities identified by GO-2026-4603 and GO-2026-4601.
breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.

Check if affected (1)

breakingThe pipeline_list_objects experimental default
Applies if you set pipeline_list_objects, set listObjects-pipeline-enabled, or use a custom featureflag client.
pipeline_list_objects is enabled by default in experimental settings. The ListObjects pipeline can be disabled by setting listObjects-pipeline-enabled to false.

Source ↗

OpenFGAv1.11.6SecurityFeb 23, 2026

ACTION 1CHECK 1OTHER 1View full analysis

This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.

Action needed (1)

securitycriticalThe grpc-health-probe dependency update for CVE-2025-68121
The grpc-health-probe dependency is updated to v0.4.45 to address CVE-2025-68121.

Check if affected (1)

breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use --read-only.
The HTTP server now communicates with the gRPC server internally over a UDS instead of a TCP socket. Read-only container deployments must also set --tmpfs /tmp when using --read-only.

Source ↗

Browse by month