CVE-2026-34972: 
NixOS vulnerability analysis and mitigation

CVE-2026-34972 is an improper policy enforcement vulnerability in OpenFGA, a high-performance authorization/permission engine inspired by Google Zanzibar. Under specific conditions, BatchCheck API calls containing multiple checks for the same object, relation, and user combination — but with differing contexts — can result in incorrect authorization decisions due to a list-value cache-key collision during within-request deduplication. The vulnerability affects OpenFGA versions 1.8.0 through 1.13.1 (Go module and Docker image) and Helm chart versions 0.2.16 through 0.2.61. It was disclosed on April 6, 2026, and carries a CVSS v3.1 base score of 5.0 (Moderate) per the official GitHub advisory (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). OpenFGA's BatchCheck operation performs within-request deduplication to optimize repeated checks for the same user/object/relation tuple; however, when multiple checks share the same tuple but carry contextual data that differs in a specific way, a cache-key collision occurs. This causes the engine to reuse a previously computed authorization result for a different context, producing an incorrect policy decision. Exploitation requires: (1) the attacker has low-privileged authenticated access to the OpenFGA API, (2) the application uses BatchCheck with context-dependent authorization policies, and (3) multiple checks within a single BatchCheck call share the same user/object/relation but have differing contexts. The vulnerability was discovered and reported by researcher @bugbunny-research (Github Advisory).

Successful exploitation allows a low-privileged authenticated user to bypass authorization checks enforced by OpenFGA, potentially gaining unauthorized access to resources that should be restricted. In multi-tenant or API-driven environments where BatchCheck is used as the primary authorization decision point, this could result in unauthorized data access (confidentiality impact), unauthorized modification of data or system state (integrity impact), and potential disruption of service availability. The scope of impact is bounded to the OpenFGA authorization layer, but since OpenFGA acts as a central policy enforcement point for applications, a bypass could cascade into broader unauthorized access across dependent services (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify an application using OpenFGA versions 1.8.0–1.13.1 as its authorization backend, particularly one that exposes or proxies BatchCheck API calls and uses context-dependent authorization policies.
2. Obtain low-privileged access: Acquire valid credentials or an API token with at least low-level privileges sufficient to make BatchCheck API calls to the OpenFGA instance.
3. Craft a malicious BatchCheck request: Construct a single BatchCheck API request containing multiple check tuples that share the same user, object, and relation values, but include differing context payloads designed to trigger a cache-key collision in the deduplication logic.
4. Trigger the cache-key collision: Submit the crafted request to the OpenFGA API endpoint. The within-request deduplication mechanism reuses the authorization result from the first matching tuple for subsequent checks with the same tuple but different context, producing an incorrect (permissive) authorization decision.
5. Achieve authorization bypass: The attacker receives an allowed: true response for a check that should have been denied, granting unauthorized access to the protected resource or action within the application relying on OpenFGA for policy enforcement (Github Advisory).

• Network: Unusual or repeated BatchCheck API requests to the OpenFGA endpoint containing multiple tuples with identical user/object/relation combinations but differing context fields within a single request body.
• Logs: OpenFGA access logs showing BatchCheck calls from unexpected or low-privileged clients accessing high-sensitivity resources; authorization decisions returning allowed: true for resources that should be restricted for the requesting user.
• Application Behavior: Unexpected access grants in applications relying on OpenFGA for authorization, particularly for resources gated by context-dependent policies; anomalous access patterns inconsistent with the user's assigned permissions.

The primary remediation is to upgrade OpenFGA to version 1.14.0 or later, which fixes the cache-key collision in BatchCheck deduplication logic. For Helm chart deployments, upgrade to version 0.2.62 or later. No configuration-based workaround is available; if immediate patching is not possible, consider restricting network-level access to the BatchCheck API endpoint to trusted internal services only, and audit access logs for suspicious BatchCheck calls with duplicate tuple parameters. Prioritize patching for deployments that use context-dependent authorization policies with BatchCheck (Github Advisory, Red Hat Bugzilla).

The vulnerability was discovered by independent researcher @bugbunny-research, who was acknowledged by the OpenFGA project for the discovery and detailed report. The advisory was published by OpenFGA maintainer adriantam on April 6, 2026. Red Hat tracked the issue via Bugzilla with medium severity. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability disclosure channels (Github Advisory, Red Hat Bugzilla).