Github.Com Authzed Spicedb vulnerabilities

CVE-2024-27101 [HIGH] CWE-190 Integer overflow in chunking helper causes dispatching to miss elements or panic Integer overflow in chunking helper causes dispatching to miss elements or panic Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem. The issue may also lead to a panic rendering the server unavailable The following API methods are affected: - [CheckPermission](https://

CVE-2022-21646 [HIGH] CWE-155 Lookup operations do not take into account wildcards in SpiceDB Lookup operations do not take into account wildcards in SpiceDB ### Impact Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. For

CVE-2023-29193 [HIGH] CWE-209 SpiceDB binding metrics port to untrusted networks and can leak command-line flags SpiceDB binding metrics port to untrusted networks and can leak command-line flags ### Background The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics se

CVE-2025-64529 [LOW] CWE-770 SpiceDB WriteRelationships fails silently if payload is too big SpiceDB WriteRelationships fails silently if payload is too big ### Impact Users who: 1. Use the exclusion operator somewhere in their authorization schema. 1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500. 1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datas

CVE-2023-46255 [MEDIUM] CWE-532 SpiceDB leaks information in log files when URI cannot be parsed SpiceDB leaks information in log files when URI cannot be parsed SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.

CVE-2023-35930 [LOW] CWE-913 SpiceDB's LookupResources may return partial results SpiceDB's LookupResources may return partial results ### Impact Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead

CVE-2024-38361 [MEDIUM] CWE-281 SpiceDB exclusions can result in no permission returned when permission expected SpiceDB exclusions can result in no permission returned when permission expected ### Background Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. For example, given this schema: ```zed definition user {} definition folder { relation member: user relation banned: user permission view = member - banned } defi

CVE-2025-49011 [LOW] CWE-358 SpiceDB checks involving relations with caveats can result in no permission when permission is expected SpiceDB checks involving relations with caveats can result in no permission when permission is expected ### Impact On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.

CVE-2025-65111 [LOW] CWE-277 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results ### Impact If a schema includes the following characteristics: 1. Permission defined in terms of a union (`+`) 1. That union references the same relation on both sides, but one side arrows to a different permission Then you might have missing `Loo

CVE-2024-46989 [MEDIUM] CWE-269 SpiceDB having multiple caveats on resources of the same type may improperly result in no permission SpiceDB having multiple caveats on resources of the same type may improperly result in no permission ## Background Multiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected For example, given this schema: ``` definition user {} caveat somecaveat(somefield int) { somefield ==

CVE-2024-32001 [LOW] CWE-755 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used ### Background Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for *either* `folder` or `folder#parent`. This bug *only* manifests if the *same* subject

CVE-2026-40091 [MEDIUM] CWE-532 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs ### Impact When SpiceDB starts with log level `info`, the startup `"configuration"` log will include the full datastore DSN, including the plaintext password, inside `DatastoreConfig.URI`. ### Patches v1.51.1 ### Workarounds Change the log level to `warn` or `error`.

CVE-2026-46668 [LOW] CWE-285 SpiceDB: Caveat structures with nested lists can result in improper cache reuse SpiceDB: Caveat structures with nested lists can result in improper cache reuse ### Impact Users are impacted if: - They have a caveat structure with a nested list, e.g.: ```zed caveat shape(x list) { x == [["a"], "b"] } ``` - Their system exercises that caveat with either [CheckBulkPermission](https://buf.build/authzed/api/docs/main%3Aauthzed.api.v1#authzed.api.v1.PermissionsService.C

CVE-2024-48909 [LOW] CWE-172 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not ### Impact Clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResour

CVE-2026-55866 [LOW] CWE-863 SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected ### Impact Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` for a (resource, permission, subject) whose correct answer is `PERMISSIONSHIP_CONDITIONAL_PERMIS