Executive brief
SpiceDB, an open-source database used for managing application permissions, contains a flaw that can lead to incorrect authorization decisions. Under specific conditions involving complex permission rules (caveats), the system may incorrectly reuse cached results, potentially granting a user access to a resource they are not authorized to see. This could lead to unauthorized data access or privilege escalation within applications relying on SpiceDB for security.
Technical details
A vulnerability in SpiceDB's serialization and hashing logic for caveat contexts allows for hash collisions when nested lists are used. This root cause is a non-deterministic serialization of caveat context Struct objects, which leads to dispatch cache hash collisions. An attacker with low privileges can exploit this by crafting specific requests (CheckBulkPermission or LookupResources v3) where two items differ only in their caveat context; if one evaluates positively and the other negatively, the system may return an incorrect positive result due to improper cache reuse. The issue is fixed in version 1.52.0 by implementing deterministic protobuf marshalling for caveat contexts.
Affected products
- Authzed SpiceDB >=1.15.0, <1.52.0
Timeline
- 2026-04-22: patched: Fix merged into main branch via PR 3065
- 2026-04-30: patched: Official release of version 1.52.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-mqcf-gqvg-rmhm published
- 2026-06-10: disclosed: CVE-2026-46668 published to NVD