CVE-2026-33729 is a cache flaw in OpenFGA, the authorization engine. NVD scores it 9.8, while the GitHub advisory rates it Moderate. Two different check requests can share a cache key, so a stale result may be reused. Upgrade to OpenFGA 1.13.1.
What's affected
OpenFGA versions before 1.13.1 are affected. The advisory lists the Go module, the openfga/openfga Docker image below v1.13.1, and Helm charts up to openfga-0.2.58, with openfga-0.2.59 patched.
You are affected only if both are true: your model has relations that rely on condition evaluation, and caching is enabled.
How to check if you're exposed
openfga version
For containers, check the image tag, and for Helm check the chart version. Then review your authorization model for conditions and your server configuration for check caching. Without either, the advisory preconditions are not met.
What to do now
- Upgrade to OpenFGA 1.13.1, or Helm chart openfga-0.2.59.
- If you cannot upgrade immediately, consider turning off check caching for models that use conditions. This is our suggestion, not an advisory workaround.
- Review access decisions made while the issue was live if your model guards sensitive data.
Why it matters
The record lists CWE-1289, CWE-20 and CWE-345. The thread is that a key meant to identify one request also matched another. An authorization cache must key on every input that can change the answer, or it returns allow for a request that should be denied.
The record is not marked as exploited in the wild and is not in CISA KEV.
Authorization engines sit on the hot path of every request, which is why caching is common. The tradeoff is that a cache must be keyed on everything that can change the answer. When conditions feed context values into a decision, two requests that look alike to the cache can differ in the context that mattered. If your system makes allow or deny decisions from cached results, add a test that sends near identical requests with different condition inputs and checks that the answers differ as expected.
Quick check
Does this affect me without conditions?
Per the advisory, you need both conditions in your model and caching enabled.
Sources
Last reviewed: 19 October 2026.
