This release contains an experimental authorization evaluation change and an IP address matching semantics change. The remaining updates are diagnostic or storage-internal and do not require operator action.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
v1.18.0 is a security-focused release with authentication hardening and stricter configuration validation. MySQL deployments have migration and maintenance-window requirements, while OIDC deployments have required issuer and audience settings.
Check if affected (3)
securitymediumMySQL schema migrations 008
Applies if you use the
MySQL backend.v1.18.0 ships schema migrations 008 for the
MySQL backend, and they require a maintenance window. The release note points to the [operator runbook](https://github.com/openfga/openfga/blob/main/assets/migrations/mysql/collation_migrations.md) before upgrading and associates the migrations with CVE-2026-55170 and CVE-2026-55689.securityConstant-time preshared key authentication
Applies if you use preshared key authentication.
The release uses
crypto/subtle.for preshared key authentication in v1.18.0. This closes a timing side-channel caused by the prior map lookup revealing information about valid key bytes.ConstantTimeCompare securityRequired OIDC issuer and audience configuration
Applies if
authn.is set tomethod oidc.v1.18.0 requires both
authn.andoidc. issuer authn.to be set whenoidc. audience authn.ismethod oidc.
OpenFGA v1.17.1 combines correctness fixes with security-related Go toolchain and image dependency updates. The security updates address Go standard library vulnerabilities in the toolchain and released images.
Action needed (2)
securityThe
Gotoolchain, updated to1.26. 4 OpenFGA v1.17.1 updates the
Gotoolchain version to1.to address26. 4 Gostandard library vulnerabilities.security
grpc-health-probeupdated tov0.4. 52 Released images update
grpc-health-probetov0., rebuilt with4. 52 Go 1., so they no longer ship the Go standard library vulnerabilities addressed by this update.26. 4
OpenFGA v1.17.0 adds configurable trace sampling and changes cache key generation. The release concerns deployments that configure tracing or depend on cache key behavior.
Action needed (1)
securityTLV-based cache key generation
OpenFGA v1.17.0 redesigns cache key generation with
TLVbinary encoding, removing collision risk from string concatenation. It also adds per-process hash seeding to prevent hash-flooding attacks.