What’s Vulnerable › Vulnerabilities

CVE-2026-46668: SpiceDB: Caveat structures with nested lists can result in improper cache reuse

• Severity: low (CVSS 2.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-07-23
• Weakness: CWE-285

Description

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

Affected products

• authzed spicedb: from 1.15.0, < 1.52.0

References

• https://github.com/authzed/spicedb/pull/3065
• https://github.com/authzed/spicedb/releases/tag/v1.52.0
• https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm

Get alerted when CVE-2026-46668 or the next vulnerability affects your stack