CVE-2026-46668: Authzed SpiceDB improper authorization via cache collision in caveats

CVE-2026-46668 · Severity: medium · CVSS 4 · Published 2026-06-10

SpiceDB, an open-source database used for managing application permissions, contains a flaw that can lead to incorrect authorization decisions. Under specific conditions involving complex permission rules (caveats), the system may incorrectly reuse cached results, potentially granting a user access to a resource they are not authorized to see. This could lead to unauthorized data access or privilege escalation within applications relying on SpiceDB for security.

Technologies: Authzed SpiceDB, github.com/authzed/spicedb (Go). Vendors: Authzed, Go.

Quick answers

Is CVE-2026-46668 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46668 being exploited in the wild.
How severe is CVE-2026-46668?
Medium severity, with a CVSS score of 4, published 10 June 2026.
Which products and versions are affected?
Authzed SpiceDB >= 1.15.0, < 1.52.0, >=1.15.0, <1.52.0; github.com/authzed/spicedb (Go) >= 1.15.0, < 1.52.0, SEMVER:introduced=1.15.0,fixed=1.52.0.
Is there a fix for CVE-2026-46668?
Yes. github.com/authzed/spicedb (Go): upgrade to 1.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46668 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46668?
Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/authzed/spicedb (Go): upgrade to 1.52.0 or later
    go get github.com/authzed/spicedb@v1.52.0

Technical details

A vulnerability in SpiceDB's serialization and hashing logic for caveat contexts allows for hash collisions when nested lists are used. This root cause is a non-deterministic serialization of caveat context Struct objects, which leads to dispatch cache hash collisions. An attacker with low privileges can exploit this by crafting specific requests (CheckBulkPermission or LookupResources v3) where two items differ only in their caveat context; if one evaluates positively and the other negatively, the system may return an incorrect positive result due to improper cache reuse. The issue is fixed in version 1.52.0 by implementing deterministic protobuf marshalling for caveat contexts.

Affected products

  • Authzed SpiceDB >=1.15.0, <1.52.0

Identifiers

  • CVE-2026-46668
  • GHSA-mqcf-gqvg-rmhm
  • GO-2026-5514

Timeline

  • 2026-04-22: patched: Fix merged into main branch via PR 3065
  • 2026-04-30: patched: Official release of version 1.52.0
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-mqcf-gqvg-rmhm published
  • 2026-06-10: disclosed: CVE-2026-46668 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.