SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Vulnerability

CVE-2026-46668 is a low-severity vulnerability in SpiceDB, an authorization database. The issue arises when a caveat structure uses a nested list (e.g., x == [["a"], "b"]). Due to improper cache key collision, requests with identical evaluation contents but different caveat contexts may be cached incorrectly, leading to erroneous permission results [1][2].

Exploitation

An attacker can exploit this by crafting specific requests to CheckBulkPermissions or the experimental version 3 of LookupResources (enabled with --experimental-lookup-resources-version lr3). In CheckBulk, two check items that are identical except for caveat context—one positive and one negative—can cause the negative result to be replaced with the cached positive result. Similarly, in LookupResources, two resources with same evaluation but differing caveat contexts can trigger the same cache reuse [1][2].

Impact

Successful exploitation causes SpiceDB to erroneously report that a user has access to a resource they should not have access to, breaking the intended access control model [1].

Mitigation

The fix was released in SpiceDB version v1.52.0 via pull request #3065 [3]. Users are advised to upgrade. As workarounds, disable the experimental LookupResources v3 flag, or refactor caveat declarations to avoid nested lists if immediate upgrade is not possible [1][2].