Is CVE-2026-55866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55866 being exploited in the wild.

How severe is CVE-2026-55866?

Low severity, with a CVSS score of 3.7, published 14 September 2026.

Which products and versions are affected?

Authzed SpiceDB >= 1.34.0, = 1.34.0, < 1.54.0, SEMVER:introduced=1.34.0,fixed=1.54.0.

Is there a fix for CVE-2026-55866?

Yes. github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55866 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55866?

Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55866: Authzed SpiceDB incorrect authorization in caveated relations

Q: Is there a fix for CVE-2026-55866?

Yes. github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55866 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-55866?

Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55866 · Severity: low · CVSS 3.7 · Published 2026-09-14

SpiceDB is a database used to manage and check fine-grained user permissions across applications. A vulnerability exists where the system may incorrectly grant full access to a resource when it should have only granted conditional access or denied it entirely. This occurs under specific high-concurrency conditions when using complex permission rules, potentially allowing users to bypass intended restrictions.

Technologies: Authzed SpiceDB, github.com/authzed/spicedb (Go). Vendors: Authzed, Go.

Quick answers

Is CVE-2026-55866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55866 being exploited in the wild.
How severe is CVE-2026-55866?: Low severity, with a CVSS score of 3.7, published 14 September 2026.
Which products and versions are affected?: Authzed SpiceDB >= 1.34.0, < 1.54.0; github.com/authzed/spicedb (Go) >= 1.34.0, < 1.54.0, SEMVER:introduced=1.34.0,fixed=1.54.0.
Is there a fix for CVE-2026-55866?: Yes. github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55866 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55866?: Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/authzed/spicedb (Go): upgrade to 1.54.0 or later
```
go get github.com/authzed/spicedb@v1.54.0
```

Technical details

A race condition in SpiceDB's dispatch result cache can lead to incorrect authorization outcomes (CWE-863). When a schema uses intersections or exclusions involving both caveated and non-caveated branches, concurrent calls to CheckPermission and LookupResources can cause the cache to return a 'HAS_PERMISSION' result instead of 'CONDITIONAL_PERMISSION' or 'NO_PERMISSION'. This occurs because the cache may intermittently serve a result that ignores the required context or caveat conditions. The issue is present when the dispatch result cache is enabled and specific schema patterns are met. A fix is available in version 1.54.0, and a workaround involves disabling the dispatch result cache.

Affected products

Authzed SpiceDB >= 1.34.0, < 1.54.0

Identifiers

CVE-2026-55866
GHSA-4vrg-r928-h5vv
GO-2026-5133

Timeline

2026-06-19: disclosed
2026-06-19: advisory
1.54.0: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.