Releases — RATATOSK

OpenFGAv1.14.1SecurityApr 10, 2026

A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.

Check if affected (2)

securityAuthZEN discovery metadata endpoint URLs
Applies if authzen.baseURL is configured.
AuthZEN discovery metadata now publishes endpoint URLs from the configured authzen.baseURL instead of request-supplied host headers, preventing host-header poisoning.
securityThe github.com/docker/docker test dependency, replaced with Moby
Applies if tests run.
The vulnerable github.com/docker/docker package, used only in tests, was removed and replaced with Moby (client & api).

Source ↗

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
The Playground now supports only the none authentication method. preshared key authentication is no longer supported.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. The Playground server address is specified with --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead, using the full host:port address.

Source ↗