CVE-2026-33729

# Conceptual PoC for OpenFGA Cache Key Collision (CVE-2026-33729) # This script demonstrates the logic of the vulnerability, not a direct exploit. import requests def check_permission(target_url, user, relation, object_id, context): """Simulates a check request to OpenFGA""" payload = { "user": user, "relation": relation, "object": object_id, "context": context } # In a vulnerable version, different payloads might generate the same cache key print(f"Sending check request for {user} on {object_id}...") # response = requests.post(f"{target_url}/checks", json=payload) # return response.json()['allowed'] return True # Simulated response # Scenario: Attacker exploits cache key collision # 1. Legitimate User Request (Cached) # This request is evaluated and allowed, then cached. # Cache Key generated: KEY_X print("Step 1: Legitimate user (Alice) requests access.") check_permission( "http://openfga-instance", "user:alice", "can_view", "doc:public_report", {"env": "prod"} ) print("-> Allowed and Cached as KEY_X") # 2. Attacker Request (Bypass) # Attacker sends a different request that collides with KEY_X. # The system retrieves the cached result (Allowed) instead of evaluating the new request. print("\nStep 2: Attacker (Bob) sends crafted request triggering collision.") result = check_permission( "http://openfga-instance", "user:bob", "can_delete", # Sensitive operation "doc:secret_plan", # Sensitive object {"env": "staging", "trig": "collision_payload"} ) print(f"-> Result: {result} (Returned from cache KEY_X, bypassing real check)") if result: print("Vulnerability Exploited: Unauthorized access granted via cache reuse.")

{"cve": {"id": "CVE-2026-33729", "sourceIdentifier": "[email protected]", "published": "2026-03-27T01:16:20.367", "lastModified": "2026-04-14T01:04:41.103", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache key. This can result in OpenFGA reusing an earlier cached result for a different request. Users are affected if the model has relations which rely on condition evaluation andncaching is enabled. OpenFGA v1.13.1 contains a patch."}, {"lang": "es", "value": "OpenFGA es un motor de autorización/permisos de alto rendimiento y flexible, construido para desarrolladores e inspirado en Google Zanzibar. En versiones anteriores a la 1.13.1, bajo condiciones específicas, los modelos que usan condiciones con el almacenamiento en caché habilitado pueden resultar en que dos solicitudes de verificación diferentes produzcan la misma clave de caché. Esto puede resultar en que OpenFGA reutilice un resultado previamente almacenado en caché para una solicitud diferente. Los usuarios se ven afectados si el modelo tiene relaciones que dependen de la evaluación de condiciones y el almacenamiento en caché está habilitado. OpenFGA v1.13.1 contiene un parche."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-1289"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.13.1", "matchCriteriaId": "F3AA7E6C-D84E-4E3C-864D-B3E82D09D69C"}]}]}], "references": [{"url": "https://github.com/openfga/openfga/commit/049b50ccd2cc7e163bd897f3d17a7b859ad146f8", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/openfga/openfga/releases/tag/v1.13.1", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/openfga/openfga/security/advisories/GHSA-h6c8-cww8-35hf", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}