Releases

Check if affected (3)

• securitymediumMySQL schema migrations 008

  Applies if you use the MySQL backend.

  v1.18.0 ships schema migrations 008 for the MySQL backend, and they require a maintenance window. The release note points to the [operator runbook](https://github.com/openfga/openfga/blob/main/assets/migrations/mysql/collation_migrations.md) before upgrading and associates the migrations with CVE-2026-55170 and CVE-2026-55689.

• securityConstant-time preshared key authentication

  Applies if you use preshared key authentication.

  The release uses crypto/subtle.ConstantTimeCompare for preshared key authentication in v1.18.0. This closes a timing side-channel caused by the prior map lookup revealing information about valid key bytes.

• securityRequired OIDC issuer and audience configuration

  Applies if authn.method is set to oidc.

  v1.18.0 requires both authn.oidc.issuer and authn.oidc.audience to be set when authn.method is oidc.

Check if affected (2)

• securityAuthZEN discovery metadata endpoint URLs

  Applies if authzen.baseURL is configured.

  AuthZEN discovery metadata now publishes endpoint URLs from the configured authzen.baseURL instead of request-supplied host headers, preventing host-header poisoning.

• securityThe github.com/docker/docker test dependency, replaced with Moby

  Applies if tests run.

  The vulnerable github.com/docker/docker package, used only in tests, was removed and replaced with Moby (client & api).

Check if affected (1)

• securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed

  Applies if Check requests use conditions and caching is enabled.

  The fix addresses CVE-2026-33729 and GHSA-h6c8-cww8-35hf in Check requests with conditions and caching enabled, which could return incorrect cached results. This correction ships in this release.