GHSA-8396-jffm-qx4w — OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorizat…

2026-09-28T17:32:17.647725+00:00

Affected: Go: github.com/openfga/openfga

### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.

### Preconditions This applies if the following preconditions are present:

- FGA runs with SharedIteratorCache enabled, - FGA runs with ListObjectsIteratorCache enabled.

### Fix Upgrade to version 1.16.0 or greater.

### Acknowledgements OpenFGA would like to thank @j4xT for the discovery and the detailed report.

Most recent entries from all

GHSA-8396-jffm-qx4w — OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorizat…