2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46668

CVE-2026-46668: SpiceDB: Caveat structures with nested lists can result in improper cache reuse

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46668

CVE-2026-46668:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authzed/spicedb	go	>= 1.15.0, < 1.52.0	1.52.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a flawed serialization mechanism for caveat contexts that contain nested lists, leading to potential hash collisions in cache keys. This could allow an attacker to poison the cache and cause SpiceDB to return incorrect, permissive authorization decisions.

The root cause is the pkg/caveats.StableContextStringForHashing function, which implemented a custom, vulnerable serialization logic. This logic did not uniquely represent distinct nested list structures, causing different contexts to produce identical strings for hashing.

The patch addresses this by completely replacing the custom serialization with a call to the deterministic marshaller from Google's protobuf library (proto.MarshalOptions{Deterministic: true}). This ensures that any two different context structures will produce different byte representations, thus preventing hash collisions.

The vulnerability affected multiple parts of the system that rely on caching and use this hashing function. The analysis identified the key functions that were directly using the vulnerable logic to generate cache keys for LookupResources (keys.lookupResourcesRequest2ToKey, keys.lookupResourcesRequest3ToKey) and CheckBulkPermissions (v1.computeCallHash) requests. These are the functions that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

caveats.StableContextStringForHashing

pkg/caveats/context_hash.go

This function was responsible for serializing a caveat's context into a string for hashing. The original implementation had a flaw in its custom serialization logic for nested lists, which could lead to different structures producing the same string, causing a hash collision. This is the root cause of the vulnerability.

keys.lookupResourcesRequest2ToKey

internal/dispatch/keys/computed.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.