CVE-2026-34972: OpenFGA Auth Bypass Vulnerability

CVE-2026-34972 Overview

CVE-2026-34972 is an authorization bypass vulnerability affecting OpenFGA, a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. The vulnerability exists in versions 1.8.0 through 1.13.1 and allows improper policy enforcement under specific conditions when BatchCheck calls contain multiple checks sent for the same object, relation, and user combination.

Critical Impact

Authorization policies may not be properly enforced when BatchCheck API is used with duplicate object/relation/user combinations, potentially allowing unauthorized access to protected resources.

Affected Products

• OpenFGA versions 1.8.0 through 1.13.1

Discovery Timeline

• 2026-04-06 - CVE-2026-34972 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34972

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), indicating a fundamental flaw in how OpenFGA processes authorization decisions. The issue manifests specifically in the BatchCheck API endpoint, which is designed to evaluate multiple authorization checks in a single request for performance optimization.

When an application sends a BatchCheck request containing multiple authorization checks for the same object, relation, and user combination, the authorization engine may fail to properly evaluate each check independently. This can result in authorization decisions that do not accurately reflect the configured policy model, potentially granting access where it should be denied or vice versa.

The vulnerability requires network access and authenticated privileges to exploit, and the attack complexity is considered high due to the specific conditions required to trigger the improper behavior.

Root Cause

The root cause stems from improper handling of duplicate authorization check requests within a single BatchCheck call. When the BatchCheck endpoint receives multiple checks with identical object, relation, and user parameters, the internal processing logic may not correctly isolate the evaluation of each check. This can lead to race conditions or caching issues where the result of one check incorrectly influences another, bypassing the intended authorization policy enforcement.

Attack Vector

An attacker with authenticated access to a system using OpenFGA for authorization can craft malicious BatchCheck API requests that exploit this vulnerability. The attack requires:

1. Knowledge that the target application uses OpenFGA for authorization
2. The ability to send BatchCheck requests (either directly or through application functionality)
3. Crafting requests with duplicate object/relation/user combinations to trigger the improper policy evaluation

The vulnerability could allow an attacker to bypass authorization checks and gain access to resources they should not be permitted to access, or potentially deny legitimate users access to resources.

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-34972

Indicators of Compromise

• Unusual patterns in BatchCheck API requests containing duplicate object/relation/user combinations
• Authorization decisions that appear inconsistent with the configured policy model
• Unexpected access grants or denials in application audit logs
• Increased BatchCheck API usage from specific users or services

Detection Strategies

• Implement logging and monitoring for all BatchCheck API calls to OpenFGA
• Create alerts for BatchCheck requests containing duplicate authorization check parameters
• Review application logs for authorization decisions that contradict expected policy behavior
• Deploy network-level monitoring to detect anomalous API request patterns to OpenFGA endpoints

Monitoring Recommendations

• Enable detailed audit logging on the OpenFGA instance to capture all authorization requests and responses
• Monitor for patterns where the same user repeatedly checks authorization for identical object/relation combinations
• Set up alerting for authorization failures followed by successes for the same resource without policy changes
• Review access patterns for resources protected by OpenFGA for anomalous behavior

How to Mitigate CVE-2026-34972

Immediate Actions Required

• Upgrade OpenFGA to version 1.14.0 or later immediately
• Review application code to identify usage of BatchCheck API with potentially duplicate parameters
• Audit recent authorization logs for any signs of exploitation
• Consider temporarily switching to individual Check calls instead of BatchCheck if immediate upgrade is not possible

Patch Information

The OpenFGA development team has addressed this vulnerability in version 1.14.0. Organizations using OpenFGA versions 1.8.0 through 1.13.1 should upgrade to the patched version as soon as possible.

For additional details about the patch and vulnerability, see the GitHub Security Advisory.

Workarounds

• Modify application logic to deduplicate authorization check parameters before sending BatchCheck requests
• Implement input validation at the application layer to reject duplicate object/relation/user combinations in batch requests
• Use individual Check API calls instead of BatchCheck until the upgrade can be completed
• Implement additional authorization verification at the application layer for sensitive operations

# Example: Upgrade OpenFGA using Docker
docker pull openfga/openfga:v1.14.0
docker stop openfga-container
docker run -d --name openfga-container openfga/openfga:v1.14.0