268 matches found
CVE-2026-55866
A flaw was found in SpiceDB, an open-source database system for managing application permissions. Under specific conditions, including concurrent permission checks and an enabled dispatch result cache, the system can incorrectly grant unconditional permission. This vulnerability arises because...
CVE-2026-55866
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866
SpiceDB (open-source permissions database), versions 1.34.0 through 1.54.0 , contains a cache-key collision bug in internal/dispatch/keys/computed.go where checkRequestToKey() and checkRequestToKeyWithCanonical() omit CheckHints when building dispatch Check cache keys. Under specific concurrency ...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
EUVD-2026-77689
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
CVE-2026-55866: Incorrect Authorization
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
GHSA-2V4P-QF9Q-27WJ vulnerabilities
Vulnerabilities for packages: opa-envoy, terraform-provider-sendgrid, k8ssandra-operator, crossplane-provider-aws-sns, sqlexporter, argo-rollouts, dex, flyte, cert-manager-csi-driver, kubernetes-csi-external-snapshotter, fluent-bit-plugin-loki, juicefs-csi-driver, cass-operator, mc,...
CVE-2026-84445 vulnerabilities
Vulnerabilities for packages: opa-envoy, terraform-provider-sendgrid, k8ssandra-operator, crossplane-provider-aws-sns, sqlexporter, argo-rollouts, dex, flyte, cert-manager-csi-driver, kubernetes-csi-external-snapshotter, fluent-bit-plugin-loki, juicefs-csi-driver, cass-operator, mc,...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: azure-service-operator, tkn, spqr, argocd-image-updater, kubernetes-csi-external-health-monitor, openfga, caddy, tekton-chains, cluster-api-gcp-controller, datadog-operator, fluent-operator, kube-state-metrics, kubernetes-csi-external-attacher, datadog-agent, grafana...
GO-2024-2597 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2023-1723 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2024-2939 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2024-2716 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2023-2166 vulnerabilities
Vulnerabilities for packages: spicedb...
GO-2026-4465 vulnerabilities
Vulnerabilities for packages: spicedb, spicedb-fips...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, spicedb...