fix(deps): update module github.com/openfga/openfga to v1.14.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/openfga/openfga	v1.13.1 → v1.14.0

---

OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision

CVE-2026-34972 / GHSA-jwvj-g8pc-cx45

More information

Details

Description

In OpenFGA, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement.

Am I affected?

You are affected if you meet the following preconditions:

1. You execute BatchCheck operations which rely on context.
2. Multiple checks are sent within a single BatchCheck operation for the same user/object/relation combination, each containing context.
3. The contexts between those checks differ in a specific way

Fix

Upgrade to OpenFGA v1.14.0

Acknowledgement

OpenFGA would like to thank @​bugbunny-research for the discovery and detailed report.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• https://github.com/openfga/openfga/security/advisories/GHSA-jwvj-g8pc-cx45
• https://nvd.nist.gov/vuln/detail/CVE-2026-34972
• https://github.com/advisories/GHSA-jwvj-g8pc-cx45

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response

CVE-2026-40293 / GHSA-68m9-983m-f3v5

More information

Details

Description

When OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments.

Am I Affected?

You are affected if you meet each of the following preconditions:

• You are running OpenFGA with --authn-method preshared, and
• The playground is enabled, and
• The playground endpoint is accessible beyond localhost or trusted networks.

Fix

Upgrade to OpenFGA v1.14.0, or disable the playground by running ./openfga run --playground-enabled=false.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://github.com/openfga/openfga/security/advisories/GHSA-68m9-983m-f3v5
• https://github.com/openfga/openfga/releases/tag/v1.14.0
• https://github.com/advisories/GHSA-68m9-983m-f3v5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

openfga/openfga (github.com/openfga/openfga)

v1.14.0

Compare Source

Added

• Initial working implementation of OpenFGA APIs (Check, Expand, Write, Read, Authorization Models, etc..)
• Postgres storage adapter implementation
• Memory storage adapter implementation
• Early support for preshared key or OIDC authentication methods

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.65.0 -> v0.67.0

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud