VulnerabilityDeferred

CVE-2026-46668

From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse.

LOW 2.3EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-285
Source: security-advisories@github.com

References

https://github.com/authzed/spicedb/pull/3065
https://github.com/authzed/spicedb/releases/tag/v1.52.0
https://github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhm

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.