CVE-2026-48096

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.16.0

Description When iterator caching is enabled, specifically with SharedIteratorCache and ListObjectsIteratorCache, two distinct check requests can produce the same cache key. This causes the system to reuse a previously cached result for a subsequent, different request.

Recommendations Upgrade to version 1.16.0 or greater. As a temporary workaround, consider disabling SharedIteratorCache and ListObjectsIteratorCache to prevent cache key collisions.