What is CVE-2026-34972?

CVE-2026-34972 is a medium-severity vulnerability in Openfga Helm Charts, classified under Incorrect Authorization. CVSS score: 5.0/10. Published 2026-04-06.

How severe is CVE-2026-34972?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Auth bypass in Openfga Helm Charts

CVE-2026-34972

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. From 1.8.0 to 1.13.1, under specific conditions, BatchCheck calls with multiple checks sent for the same object, relation, and user combination can result in improper policy enforcement. This vulnerability is fixed in 1.14.0.

Vulnerability class: Broken Access Control

EPSS: 0.002 (11.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Openfga Helm_charts
Openfga — versions >= 1.8.0, < 1.14.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-34972?: CVE-2026-34972 is a medium-severity vulnerability in Openfga Helm Charts, classified under Incorrect Authorization. CVSS score: 5.0/10. Published 2026-04-06.
How severe is CVE-2026-34972?: Medium severity. CVSS v3 base score is 5.0 out of 10.