GO-2023-2166 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2024-2939 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2026-4465 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2023-1723 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2024-2911 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector, spicedb...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dbmate, vcluster, zot, terraform-docs, kwok, gomplate, cilium-cli, terragrunt, minio, melange, conftest, opa, pulumi-language-dotnet, restic, spire-server, trivy, sigstore-scaffolding, kots, terraform-provider-google, k8sgpt, opentelemetry-collector, fulcio,...

GO-2024-2606 vulnerabilities

Vulnerabilities for packages: step-ca, argo-workflows, kine, amass, step, spicedb, trillian, ferretdb, temporal-server, kube-bench, caddy, kots, src, k3s...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, terraform-docs, podinfo, crossplane-provider-aws-kms, wuzz, aws-node-termination-handler, crossplane-provider-aws-rds, crossplane-provider-aws-sqs, gomplate, kubeflow-pipelines, knative-serving, kubevela, nri-prometheus,...

SUSE CVE-2025-64529

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that...

SUSE CVE-2026-40091

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...

SUSE CVE-2026-46668

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, external-secrets-operator, zot, kwok, kubernetes-csi-external-snapshotter, telegraf, kubeflow-pipelines, rancher-agent, kubernetes-csi-external-attacher, cloud-provider-gcp-cloud-controller-manager, node-feature-discovery, cass-operator,...

CVE-2026-46668

A flaw was found in SpiceDB, an open-source database system for managing application permissions. This vulnerability occurs due to improper cache reuse when processing caveat structures that contain nested lists. This could lead to unexpected behavior or a low impact on confidentiality, potential...

GO-2026-5514 SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb

SpiceDB: Caveat structures with nested lists can result in improper cache reuse in github.com/authzed/spicedb...

GO-2026-5465 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs in github.com/authzed/spicedb

SpiceDB's SPICEDBDATASTORECONNURI is leaked on startup logs in github.com/authzed/spicedb...

GO-2026-5133 SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the permission evaluation process under concurrent requests involving both CheckPermission/CheckBulkPermissions and LookupResources with a context parameter, when the dispatch result cache is enabled. An...

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected

Impact Under concurrency, CheckPermission and CheckBulkPermissions can return PERMISSIONSHIPHASPERMISSION for a resource, permission, subject whose correct answer is PERMISSIONSHIPCONDITIONALPERMISSION. You are impacted if all of the following hold: 1. Your schema has a permission combining...

CVE-2026-46668

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource through improper handling of caveat structures containing nested lists in the caching process. An attacker can gain unauthorized access to protected resources by crafting requests th...