Suse CVE-2026-33729

OpenFGA is an open-source fine-grained authorization system written in Go (pkg:go/github.com_openfga_openfga). The vulnerability stems from inadequate cache key generation in the condition evaluation subsystem, classified under CWE-20 (Improper Input Validation). When models incorporate relation conditions-complex authorization logic that evaluates contextual constraints-the caching layer fails to differentiate between semantically distinct permission checks, creating cache collisions. An attacker positioned to issue sequential authorization requests can exploit this deterministic cache key collision to retrieve cached authorization results from prior requests with different contexts, effectively bypassing intended permission boundaries. The root cause is insufficient entropy or scope isolation in the cache key derivation algorithm when conditions are present.