GHSA-8396-jffm-qx4w
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
Quick fix
GHSA-8396-jffm-qx4w — github.com/openfga/openfga: upgrade to the fixed version with the command below.
go get github.com/openfga/openfga@v1.16.0Details
### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key, leading to OpenFGA reusing an earlier cached result for a subsequent request.
### Preconditions This applies if the following preconditions are present:
- FGA runs with SharedIteratorCache enabled, - FGA runs with ListObjectsIteratorCache enabled.
### Fix Upgrade to version 1.16.0 or greater.
### Acknowledgements OpenFGA would like to thank @j4xT for the discovery and the detailed report.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 1.16.0go get github.com/openfga/openfga@v1.16.0