# CVE-2026-46668: Authzed SpiceDB improper authorization via cache collision in caveats

Source: https://junglewise.ai/threats/cve-2026-46668-authzed-spicedb-improper-authorization-via-cache-collision-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46668 · Severity: medium · CVSS 4 · Published 2026-06-10

SpiceDB, an open-source database used for managing application permissions, contains a flaw that can lead to incorrect authorization decisions. Under specific conditions involving complex permission rules (caveats), the system may incorrectly reuse cached results, potentially granting a user access to a resource they are not authorized to see. This could lead to unauthorized data access or privilege escalation within applications relying on SpiceDB for security.

Technologies: [Authzed SpiceDB](https://junglewise.ai/threats/technologies/spicedb), [github.com/authzed/spicedb (Go)](https://junglewise.ai/threats/technologies/github-com-authzed-spicedb). Vendors: [Authzed](https://junglewise.ai/threats/vendors/authzed), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-46668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46668 being exploited in the wild.

**How severe is CVE-2026-46668?** Medium severity, with a CVSS score of 4, published 10 June 2026.

**Which products and versions are affected?** Authzed SpiceDB >= 1.15.0, < 1.52.0, >=1.15.0, <1.52.0; github.com/authzed/spicedb (Go) >= 1.15.0, < 1.52.0, SEMVER:introduced=1.15.0,fixed=1.52.0.

**Is there a fix for CVE-2026-46668?** Yes. github.com/authzed/spicedb (Go): upgrade to 1.52.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46668 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-46668?** Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/authzed/spicedb (Go): upgrade to 1.52.0 or later

  ```sh
  go get github.com/authzed/spicedb@v1.52.0
  ```


## Technical details

A vulnerability in SpiceDB's serialization and hashing logic for caveat contexts allows for hash collisions when nested lists are used. This root cause is a non-deterministic serialization of caveat context Struct objects, which leads to dispatch cache hash collisions. An attacker with low privileges can exploit this by crafting specific requests (CheckBulkPermission or LookupResources v3) where two items differ only in their caveat context; if one evaluates positively and the other negatively, the system may return an incorrect positive result due to improper cache reuse. The issue is fixed in version 1.52.0 by implementing deterministic protobuf marshalling for caveat contexts.

## Affected products

- Authzed SpiceDB >=1.15.0, <1.52.0

## Identifiers

- CVE-2026-46668
- GHSA-mqcf-gqvg-rmhm
- GO-2026-5514

## Timeline

- 2026-04-22: patched: Fix merged into main branch via PR 3065
- 2026-04-30: patched: Official release of version 1.52.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-mqcf-gqvg-rmhm published
- 2026-06-10: disclosed: CVE-2026-46668 published to NVD

## References

- [https://github.com/authzed/spicedb/pull/3065](https://github.com/authzed/spicedb/pull/3065)
- [https://github.com/authzed/spicedb/releases/tag/v1.52.0](https://github.com/authzed/spicedb/releases/tag/v1.52.0)
- [https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm](https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm)

## Related threats

- [Authzed SpiceDB incorrect authorization in caveated relations](https://junglewise.ai/threats/cve-2026-55866-authzed-spicedb-incorrect-authorization-in-caveated-relations)
- [SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.](https://junglewise.ai/threats/cve-2026-40091-authzed-spicedb-sensitive-information-leak-in-startup-logs)
- [GO-2026-4465 - LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in…](https://junglewise.ai/threats/go-2026-4465-lookupresources-cursor-section-tampering-can-crash-spicedb-183b4312)
- [LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic](https://junglewise.ai/threats/lookupresources-cursor-section-tampering-can-crash-spicedb-process-via-4334d59b)
- [Authzed SpiceDB incomplete LookupResources results in complex schemas](https://junglewise.ai/threats/cve-2025-65111-authzed-spicedb-incomplete-lookupresources-results-in-complex)