CVE-2026-41131: 
NixOS vulnerability analysis and mitigation

CVE-2026-41131 is a cache key collision vulnerability in OpenFGA, an open-source authorization/permission engine, classified as "Improper Policy Enforcement." In specific scenarios, models using conditions with caching enabled can result in two different check requests producing the same cache key, causing OpenFGA to return a previously cached authorization result for a different, subsequent request. The vulnerability affects OpenFGA versions prior to 1.14.1 (Go module github.com/openfga/openfga), Docker image openfga/openfga prior to v1.14.1, and Helm Charts prior to 0.3.1. It was published on April 20–22, 2026, and carries a CVSS v3.1 base score of 5.0 (Medium) (Github Advisory, OpenFGA Advisory).

The root cause is improper cache key generation in OpenFGA's check request handling, classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference) and CWE-863 (Incorrect Authorization). When a model has relations that rely on condition evaluation and caching is enabled, the cache key derivation logic fails to sufficiently differentiate between distinct check requests — particularly those involving conditions and context — allowing a collision where two semantically different requests map to the same key. The fix in v1.14.1 improves cache key generation by removing fmt usage and extending control-character sanitization to all cache key inputs (tuples, conditions, and context), as noted in the release changelog (OpenFGA Release). Exploitation requires low privileges (an authenticated user able to issue check requests) and high attack complexity, as the attacker must craft specific requests that trigger the collision (Github Advisory).

Successful exploitation allows a low-privileged network attacker to cause OpenFGA to return incorrect authorization decisions, potentially granting access to resources the requester should not be permitted to access. This results in low-level confidentiality, integrity, and availability impacts: unauthorized read access to protected data, unauthorized modification of resources, and potential disruption of authorization decisions. The impact is scoped to deployments where both condition-based relations and caching are simultaneously enabled in OpenFGA models (OpenFGA Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.034–0.046%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was responsibly disclosed by researcher @bugbunny-research (OpenFGA Advisory).

The primary remediation is to upgrade OpenFGA to version 1.14.1 or later (Go module), Docker image openfga/openfga:v1.14.1, or Helm Charts version 0.3.1 (OpenFGA Release, Github Advisory). As a temporary workaround if immediate patching is not feasible, disabling the caching feature in OpenFGA eliminates the precondition for exploitation. Organizations should also audit their OpenFGA models to identify relations relying on condition evaluation, as these are the configurations at risk.

The advisory was published by OpenFGA maintainer justincoh on April 20, 2026, and acknowledged researcher @bugbunny-research for the detailed report (OpenFGA Advisory). The vulnerability received routine coverage from automated CVE tracking services and vulnerability databases, with no notable broader media coverage or significant community discussion identified beyond standard disclosure channels.