What’s Vulnerable › Products

authzed spicedb vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your authzed spicedb version is affected

Latest authzed spicedb vulnerabilities

• CVE-2026-55866 — SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected (CVSS 3.7)
• CVE-2026-46668 — SpiceDB: Caveat structures with nested lists can result in improper cache reuse (CVSS 2.3)
• CVE-2026-40091 — SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs (CVSS 4.4)
• CVE-2025-65111 — SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results (CVSS 5.3)
• CVE-2025-64529 — SpiceDB's WriteRelationships fails silently if payload is too big (CVSS 6.5)
• CVE-2025-49011 — SpiceDB checks involving relations with caveats can result in no permission when permission is expected (CVSS 5.3)
• CVE-2024-48909 — SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not (CVSS 2.4)
• CVE-2024-46989 — Multiple caveats on resources of the same type can result in no permission when permission is expected (CVSS 5.3)
• CVE-2024-38361 — Permissions processing error in spacedb (CVSS 5.3)
• CVE-2024-32001 — SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used (CVSS 4.3)
• CVE-2024-27101 — Integer overflow in chunking helper causes dispatching to miss elements or panic (CVSS 9.1)
• CVE-2023-46255 — `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed (CVSS 6.5)
• CVE-2023-35930 — LookupResources may return partial results in spicedb (CVSS 5.3)
• CVE-2023-29193 — SpiceDB binding metrics port to untrusted networks and can leak command-line flags (CVSS 7.5)
• CVE-2022-21646 — Lookup operations do not take into account wildcards in SpiceDB (CVSS 8.1)