Releases — RATATOSK

OpenFGAv1.14.0SecurityApr 3, 2026

ACTION 1CHECK 1PLAN 2OTHER 5View full analysis

This release adds an operator-facing histogram metric and ListObjects performance improvements, fixes PostgreSQL and ListObjects defects, and addresses improper BatchCheck policy enforcement. Playground users face a breaking authentication constraint, while the built-in Playground and its port settings are deprecated.

Action needed (1)

securitymediumBatchCheck policy enforcement fix for CVE-2026-34972
The issue was fixed where BatchCheck calls with multiple checks for the same tuple could result in improper policy enforcement. The fix addresses CVE-2026-34972 and GHSA-jwvj-g8pc-cx45.

Check if affected (1)

breakingPlayground authentication limited to none
Applies if the Playground runs with preshared key authentication.
The Playground now supports only the none authentication method. preshared key authentication is no longer supported.

Plan ahead (2)

deprecatedBuilt-in OpenFGA Playground deprecationremoval date not announced
Applies if you use the built-in OpenFGA Playground.
The built-in OpenFGA Playground is deprecated and intended only for development. It will be removed entirely in a future release.
deprecated--playground-port and OPENFGA_PLAYGROUND_PORT deprecation
Applies if you configure --playground-port or OPENFGA_PLAYGROUND_PORT.
The --playground-port flag and OPENFGA_PLAYGROUND_PORT environment variable are deprecated. The Playground server address is specified with --playground-addr (OPENFGA_PLAYGROUND_ADDR) instead, using the full host:port address.

Source ↗