# github.com/authzed/spicedb (Go) vulnerabilities 15 known vulnerabilities (3 high, 2 medium, 10 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/authzed/spicedb ## Advisories (15) ### [CVE-2026-55866](https://cve.now/CVE-2026-55866): SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected - Severity: Low 3.7 - Published: Sep 14, 2026 - Affected: from 1.34.0, fixed in 1.54.0. ### [CVE-2026-46668](https://cve.now/CVE-2026-46668): SpiceDB: Caveat structures with nested lists can result in improper cache reuse - Severity: Low 2.3 - Published: Jun 10, 2026 - Affected: from 1.15.0, fixed in 1.52.0. ### [CVE-2026-40091](https://cve.now/CVE-2026-40091): SpiceDB: SPICEDB\_DATASTORE\_CONN\_URI is leaked on startup logs - Severity: Medium 6.0 - Published: Apr 14, 2026 - Affected: from 1.49.0, fixed in 1.51.1. ### [CVE-2025-65111](https://cve.now/CVE-2025-65111): SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results - Severity: Low 2.9 - Published: Nov 21, 2025 - Affected: fixed in 1.47.1. ### [CVE-2025-64529](https://cve.now/CVE-2025-64529): SpiceDB's WriteRelationships fails silently if payload is too big - Severity: Low 2.7 - Published: Nov 10, 2025 - Affected: fixed in 1.45.2. ### [CVE-2025-49011](https://cve.now/CVE-2025-49011): SpiceDB checks involving relations with caveats can result in no permission when permission is expected - Severity: Low 3.7 - Published: Jun 6, 2025 - Affected: fixed in 1.44.2. ### [CVE-2024-48909](https://cve.now/CVE-2024-48909): SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not - Severity: Low 2.0 - Published: Oct 14, 2024 - Affected: from 1.35.0, fixed in 1.37.1. ### [CVE-2024-46989](https://cve.now/CVE-2024-46989): Multiple caveats on resources of the same type can result in no permission when permission is expected - Severity: Low 3.7 - Published: Sep 18, 2024 - Affected: fixed in 1.35.3. ### [CVE-2024-38361](https://cve.now/CVE-2024-38361): Permissions processing error in spacedb - Severity: Low 3.7 - Published: Jun 20, 2024 - Affected: fixed in 1.33.1. ### [CVE-2024-32001](https://cve.now/CVE-2024-32001): SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used - Severity: Low 2.2 - Published: Apr 10, 2024 - Affected: fixed in 1.30.1. ### [CVE-2024-27101](https://cve.now/CVE-2024-27101): Integer overflow in chunking helper causes dispatching to miss elements or panic - Severity: High 7.3 - Published: Mar 1, 2024 - Affected: fixed in 1.29.2. ### [CVE-2023-46255](https://cve.now/CVE-2023-46255): \`SPICEDB\_DATASTORE\_CONN\_URI\` is leaked when URI cannot be parsed - Severity: Medium 4.2 - Published: Oct 31, 2023 - Affected: fixed in 1.27.0-rc1. ### [CVE-2023-35930](https://cve.now/CVE-2023-35930): LookupResources may return partial results in spicedb - Severity: Low 3.7 - Published: Jun 26, 2023 - Affected: from 1.22.0, fixed in 1.22.2; from 1.22.0, fixed in 1.22.2. ### [CVE-2023-29193](https://cve.now/CVE-2023-29193): SpiceDB binding metrics port to untrusted networks and can leak command-line flags - Severity: High 8.7 - Published: Apr 14, 2023 - Affected: fixed in 1.19.1. ### [CVE-2022-21646](https://cve.now/CVE-2022-21646): Lookup operations do not take into account wildcards in SpiceDB - Severity: High 8.1 - Published: Jan 11, 2022 - Affected: from 1.3.0, fixed in 1.4.0; from 1.3.0, fixed in 1.4.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/authzed/spicedb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.