# github.com/authzed/spicedb (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-authzed-spicedb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-authzed-spicedb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in github.com/authzed/spicedb (Go): 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55866, was published on 14 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 17 (0 critical, 0 exploited in the wild) ## About github.com/authzed/spicedb (Go) Open source authorization engine for providing consistent permission management across applications. ## Latest github.com/authzed/spicedb (Go) vulnerabilities - [CVE-2026-55866: Authzed SpiceDB incorrect authorization in caveated relations](https://junglewise.ai/threats/cve-2026-55866-authzed-spicedb-incorrect-authorization-in-caveated-relations) (low, CVSS 3.7, published 14 Sep 2026) - [CVE-2026-46668: Authzed SpiceDB improper authorization via cache collision in caveats](https://junglewise.ai/threats/cve-2026-46668-authzed-spicedb-improper-authorization-via-cache-collision-in) (medium, CVSS 4, published 10 Jun 2026) - [CVE-2026-40091: SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions…](https://junglewise.ai/threats/cve-2026-40091-authzed-spicedb-sensitive-information-leak-in-startup-logs) (medium, CVSS 6, published 15 Apr 2026) - [GO-2026-4465 - LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in…](https://junglewise.ai/threats/go-2026-4465-lookupresources-cursor-section-tampering-can-crash-spicedb-183b4312) (info, published 17 Feb 2026) - [LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic](https://junglewise.ai/threats/lookupresources-cursor-section-tampering-can-crash-spicedb-process-via-4334d59b) (medium, CVSS 4, published 6 Feb 2026) - [CVE-2025-65111: Authzed SpiceDB incomplete LookupResources results in complex schemas](https://junglewise.ai/threats/cve-2025-65111-authzed-spicedb-incomplete-lookupresources-results-in-complex) (medium, CVSS 5.3, published 21 Nov 2025) - [CVE-2025-64529: Authzed SpiceDB silent failure in WriteRelationships](https://junglewise.ai/threats/cve-2025-64529-authzed-spicedb-silent-failure-in-writerelationships) (medium, CVSS 6.5, published 13 Nov 2025) - [CVE-2025-49011: SpiceDB checks involving relations with caveats can result in no permission when permission is expected](https://junglewise.ai/threats/cve-2025-49011-spicedb-checks-involving-relations-with-caveats-can-result-in-no) (low, CVSS 3.1, published 10 Jun 2025) - [CVE-2024-48909: SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not](https://junglewise.ai/threats/cve-2024-48909-spicedb-calls-to-lookupresources-using-lookupresources2-with) (low, CVSS 3.1, published 15 Oct 2024) - [CVE-2024-46989: SpiceDB having multiple caveats on resources of the same type may improperly result in no permission](https://junglewise.ai/threats/cve-2024-46989-spicedb-having-multiple-caveats-on-resources-of-the-same-type-may) (low, CVSS 3.1, published 25 Sep 2024) - [CVE-2022-21646: GO-2022-0295 - Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb](https://junglewise.ai/threats/cve-2022-21646-lookup-operations-do-not-take-into-account-wildcards-in-spicedb) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-46255: GO-2023-2166 - SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb](https://junglewise.ai/threats/cve-2023-46255-spicedb-leaks-information-in-log-files-when-uri-cannot-be-parsed) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-35930: GO-2023-1871 - SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb](https://junglewise.ai/threats/cve-2023-35930-spicedb-s-lookupresources-may-return-partial-results) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2023-29193: GO-2023-1723 - SpiceDB binding metrics port to untrusted networks and can leak command-line flags in…](https://junglewise.ai/threats/cve-2023-29193-spicedb-binding-metrics-port-to-untrusted-networks-and-can-leak) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2024-38361: GO-2024-2939 - SpiceDB exclusions can result in no permission returned when permission expected in…](https://junglewise.ai/threats/cve-2024-38361-spicedb-exclusions-can-result-in-no-permission-returned-when) (low, CVSS 3.1, published 28 Jun 2024) - [CVE-2024-32001: SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used](https://junglewise.ai/threats/cve-2024-32001-spicedb-lookupsubjects-may-return-partial-results-if-a-specific) (low, CVSS 3.1, published 4 Jun 2024) - [CVE-2024-27101: GO-2024-2597 - Integer overflow in chunking helper causes dispatching to miss elements or panic in…](https://junglewise.ai/threats/cve-2024-27101-integer-overflow-in-chunking-helper-causes-dispatching-to-miss) (low, CVSS 3.1, published 4 Jun 2024) ## Most severe github.com/authzed/spicedb (Go) vulnerabilities - [CVE-2025-64529: Authzed SpiceDB silent failure in WriteRelationships](https://junglewise.ai/threats/cve-2025-64529-authzed-spicedb-silent-failure-in-writerelationships) (medium, CVSS 6.5, published 13 Nov 2025) - [CVE-2026-40091: SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions…](https://junglewise.ai/threats/cve-2026-40091-authzed-spicedb-sensitive-information-leak-in-startup-logs) (medium, CVSS 6, published 15 Apr 2026) - [CVE-2025-65111: Authzed SpiceDB incomplete LookupResources results in complex schemas](https://junglewise.ai/threats/cve-2025-65111-authzed-spicedb-incomplete-lookupresources-results-in-complex) (medium, CVSS 5.3, published 21 Nov 2025) - [CVE-2026-46668: Authzed SpiceDB improper authorization via cache collision in caveats](https://junglewise.ai/threats/cve-2026-46668-authzed-spicedb-improper-authorization-via-cache-collision-in) (medium, CVSS 4, published 10 Jun 2026) - [LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic](https://junglewise.ai/threats/lookupresources-cursor-section-tampering-can-crash-spicedb-process-via-4334d59b) (medium, CVSS 4, published 6 Feb 2026) - [CVE-2026-55866: Authzed SpiceDB incorrect authorization in caveated relations](https://junglewise.ai/threats/cve-2026-55866-authzed-spicedb-incorrect-authorization-in-caveated-relations) (low, CVSS 3.7, published 14 Sep 2026) - [CVE-2022-21646: GO-2022-0295 - Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb](https://junglewise.ai/threats/cve-2022-21646-lookup-operations-do-not-take-into-account-wildcards-in-spicedb) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-29193: GO-2023-1723 - SpiceDB binding metrics port to untrusted networks and can leak command-line flags in…](https://junglewise.ai/threats/cve-2023-29193-spicedb-binding-metrics-port-to-untrusted-networks-and-can-leak) (low, CVSS 3.1, published 20 Aug 2024) - [CVE-2024-32001: SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used](https://junglewise.ai/threats/cve-2024-32001-spicedb-lookupsubjects-may-return-partial-results-if-a-specific) (low, CVSS 3.1, published 4 Jun 2024) - [CVE-2024-27101: GO-2024-2597 - Integer overflow in chunking helper causes dispatching to miss elements or panic in…](https://junglewise.ai/threats/cve-2024-27101-integer-overflow-in-chunking-helper-causes-dispatching-to-miss) (low, CVSS 3.1, published 4 Jun 2024) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/authzed/spicedb (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-authzed-spicedb, 13 November 2026.