Authzed Spicedb vulnerabilities

• authzed spicedb SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected CVE-2026-55866 Fix available 3.7 LowJune 19, 2026
• authzed spicedb SpiceDB: Caveat structures with nested lists can result in improper cache reuse CVE-2026-46668 Fix available 2.3 LowMay 21, 2026
• authzed spicedb SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CVE-2026-40091 Fix available 6.0 MediumApril 14, 2026
• authzed spicedb SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results CVE-2025-65111 Fix available 2.9 LowNovember 21, 2025
• authzed spicedb SpiceDB's WriteRelationships fails silently if payload is too big CVE-2025-64529 Fix available 2.7 LowNovember 10, 2025
• authzed spicedb SpiceDB checks involving relations with caveats can result in no permission when permission is expected CVE-2025-49011 Fix available 3.7 LowJune 6, 2025
• authzed spicedb SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not CVE-2024-48909 Fix available 2.0 LowOctober 14, 2024
• authzed spicedb Multiple caveats on resources of the same type can result in no permission when permission is expected CVE-2024-46989 Fix available 3.7 LowSeptember 18, 2024
• authzed spicedb Permissions processing error in spacedb CVE-2024-38361 Fix available 3.7 LowJune 20, 2024
• authzed spicedb SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used CVE-2024-32001 Fix available 2.2 LowApril 10, 2024
• authzed spicedb Integer overflow in chunking helper causes dispatching to miss elements or panic CVE-2024-27101 Fix available 7.3 HighMarch 1, 2024
• authzed spicedb `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed CVE-2023-46255 Fix available 4.2 MediumOctober 31, 2023
• authzed spicedb LookupResources may return partial results in spicedb CVE-2023-35930 Fix available 3.7 LowJune 26, 2023
• authzed spicedb SpiceDB binding metrics port to untrusted networks and can leak command-line flags CVE-2023-29193 Fix available 8.7 HighApril 13, 2023
• authzed spicedb Lookup operations do not take into account wildcards in SpiceDB CVE-2022-21646 Fix available 8.1 HighJanuary 11, 2022