CVE-2026-46668

LowCVSS 2.3

Published: 10/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

In SpiceDB from version 1.15.0 to before 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

Risk Assessment

Improper cache reuse can lead to authorization errors, potentially allowing unauthorized access to resources protected by SpiceDB.

Recommendation

Update SpiceDB to version 1.52.0 or later.

Original NVD description (English source)

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.