OpenFGA v1.18.3 includes a correctness fix for an experimental graph check. No operator-facing change details are included in the recorded release items.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: OpenFGAClear ×
A maintenance release with diagnostic logging, experimental cache metric changes, and corrections for weighted-graph and tuple-validation defects. It also updates the Go toolchain and embedded grpc-health-probe in released images.
Action needed (1)
securityhigh
grpc-health-proberebuilt atv0.4. 53 The embedded
grpc-health-probeis rebuilt with Go 1.26.5 and bumped tov0.in released images. The update addresses the Go standard library vulnerabilities documented in the Go 1.26.5 release notes, including CVE-2026-39822.4. 53
This release contains an experimental authorization evaluation change and an IP address matching semantics change. The remaining updates are diagnostic or storage-internal and do not require operator action.
Source ↗v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the
MySQL backend.v1.18.0 ships schema migrations 008 for the
MySQL backend, and they require a maintenance window. The release note points to the [operator runbook](https://github.com/openfga/openfga/blob/main/assets/migrations/mysql/collation_migrations.md) before upgrading and associates the migrations with CVE-2026-55170 and CVE-2026-55689.securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
The release uses
crypto/subtle.for preshared key authentication in v1.18.0. This closes a timing side-channel caused by the prior map lookup revealing information about valid key bytes.ConstantTimeCompare securityRequired OIDC issuer and audience configuration
Applies if
authn.is set tomethod oidc.v1.18.0 requires both
authn.andoidc. issuer authn.to be set whenoidc. audience authn.ismethod oidc.
OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.
Action needed (2)
securityThe
Gotoolchain, updated to1.26. 4 OpenFGA v1.17.1 updates the
Gotoolchain version to1.to address26. 4 Gostandard library vulnerabilities.security
grpc-health-probeupdated tov0.4. 52 Released images update
grpc-health-probetov0., rebuilt with4. 52 Go 1., so they no longer ship the Go standard library vulnerabilities addressed by this update.26. 4
OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.
Action needed (1)
securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with
TLVbinary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.
OpenFGA v1.16.1 includes a third-party dependency update for multiple CVEs in the Go standard library. It also corrects defects in the experimental weighted_graph_check behavior.
Action needed (1)
securityThe
grpc-health-probedependency updategrpc-health-probeis updated tov0.to address multiple CVEs in the Go standard library.4. 50
Release v1.16.0 adds datastore timeout configuration and additional tracing output. It also fixes defects in experimental weighted_graph_check and OIDC authentication, and updates the Go toolchain for standard-library vulnerability fixes.
Action needed (1)
securityThe
Gotoolchain, updated to 1.26.3The toolchain now uses
Goversion1.to address vulnerabilities in the26. 3 Gostandard library. This update ships in v1.16.0.
OpenFGA v1.15.1 is a correctness-focused release. The available release information points to fixes in command error handling, object listing, experimental graph checks, bounded tuple reads, and check request handling.
Source ↗This release updates the Go toolchain alongside changes to authorization behavior. The Go update addresses standard library vulnerabilities documented in the Go 1.26.2 release notes.
Action needed (1)
securityThe
Gotoolchain version, updated to1.26. 2 The toolchain
Goversion is updated to1.to address26. 2 Gostandard library vulnerabilities documented in theGo1.26.2 release notes.
This release contains an operator-facing bug fix in OpenFGA. The recorded note tail refers to delimiter handling in the experimental weighted_graph_check and added validation in v2Check.
A maintenance release adds server shutdown-timeout configuration and performance improvements in object listing and cache key generation. It also corrects an AuthZEN discovery security issue and replaces a vulnerable test dependency.
Check if affected (2)
securityAuthZEN discovery metadata endpoint URLs
Applies if
authzen.is configured.baseURL AuthZEN discovery metadata now publishes endpoint URLs from the configured
authzen.instead of request-supplied host headers, preventing host-header poisoning.baseURL securityThe
github.test dependency, replaced with Mobycom/docker/docker Applies if tests run.
The vulnerable
github.package, used only in tests, was removed and replaced withcom/docker/docker Moby (client & api).
This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.
Action needed (1)
securitymedium
BatchCheckpolicy enforcement fix for CVE-2026-34972The issue was fixed where
BatchCheckcalls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.
Check if affected (1)
breaking
Playgroundauthentication limited tononeApplies if the
Playgroundruns withpresharedkey authentication.The
Playgroundnow supports only thenoneauthentication method.presharedkey authentication is no longer supported.
Plan ahead (2)
deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated
--playground-portandOPENFGA_PLAYGROUND_PORTdeprecationApplies if you configure
--playground-portorOPENFGA_PLAYGROUND_PORT.The
--playground-portflag andOPENFGA_PLAYGROUND_PORTenvironment variable are deprecated. The Playground server address is specified with--playground-addr(OPENFGA_PLAYGROUND_ADDR) instead, using the fullhost:portaddress.
A maintenance release fixes a disclosed security vulnerability in Check requests with conditions and caching enabled, which could return incorrect cached results. The fix addresses the interaction between conditional checks and caching.
Check if affected (1)
securitymediumCVE-2026-33729 and GHSA-h6c8-cww8-35hf fixed
Applies if
Checkrequests use conditions and caching is enabled.The fix addresses CVE-2026-33729 and GHSA-h6c8-cww8-35hf in
Checkrequests with conditions and caching enabled, which could return incorrect cached results. This correction ships in this release.
This release adds experimental AuthZen 1.0 support and changes observability output for list-objects operations. It also includes fixes for recoverable panics.
Source ↗OpenFGA v1.12.1 contains a dependency version update and a correction to OTLP endpoint handling. The available release information points to changes that affect operator configuration and dependency versions, while internal implementation refactors do not affect users directly.
Source ↗A maintenance release adds gRPC message-size configuration, changes TLS certificate rotation handling, and updates an experimental default. It also tightens tuple validation, fixes correctness issues, and updates the Go toolchain for disclosed advisories.
Action needed (2)
securityhighGo toolchain version
1.25. 8 The Go toolchain is updated to version
1.to address standard library vulnerabilities identified by25. 8 GO-2026-4603andGO-2026-4601.breakingStricter tuple string validation
Tuple validation now fails when a tuple string contains Unicode control characters or null bytes.
Check if affected (1)
breakingThe
pipeline_list_objectsexperimental defaultApplies if you set
pipeline_list_objects, setlistObjects-pipeline-enabled, or use a custom featureflag client.pipeline_list_objectsis enabled by default in experimental settings. The ListObjects pipeline can be disabled by settinglistObjects-pipeline-enabledtofalse.
This release changes the default ListObjects pipeline and narrows the requirements for read-only container deployments. It updates grpc-health-probe to address CVE-2025-68121, while the grpc-gateway client migration remains internal-only.
Action needed (1)
securitycriticalThe
grpc-health-probedependency update for CVE-2025-68121The
grpc-health-probedependency is updated tov0.to address CVE-2025-68121.4. 45
Check if affected (1)
breakingInternal HTTP-to-gRPC communication over UDS
Applies if you use
--read-only.The HTTP server now communicates with the gRPC server internally over a UDS instead of a TCP socket. Read-only container deployments must also set
--tmpfs /tmpwhen using--read-only.
This release includes an operator-facing toolchain update. The change addresses CVE-2025-68121 in OpenFGA v1.11.5.
Action needed (1)
securitycriticalThe Go toolchain, updated to
1.25. 7 The Go toolchain is updated to
1.in OpenFGA v1.11.5 to address CVE-2025-68121.25. 7
OpenFGA v1.11.4 fixes a planner regression in specific scenarios and updates the OpenTelemetry SDK. The SDK change addresses a disclosed issue affecting earlier versions.
Action needed (1)
securityThe
otel/sdkdependency atv1.40. 0 The
otel/sdkdependency is upgraded tov1.in OpenFGA v1.11.4 to address the issue identified as40. 0 SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758in earlier versions.
This release adds configuration and observability capabilities while changing throttling and metric behavior. It also fixes correctness defects, including a described improper policy enforcement issue.
Action needed (2)
securitymediumThe CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9 policy enforcement fix
The release fixes improper policy enforcement associated with CVE-2026-24851 and GHSA-jq9f-gm9w-rwm9.
breakingThe custom
grpc_codemetric label, removedThe custom
grpc_prometheusfork is replaced withgo-grpc-middleware's provider, and the customgrpc_codelabel is removed from the metric.