Low severityGHSA Advisory· Published Jun 10, 2026· Updated Jun 11, 2026

CVE-2026-46668

Description

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/authzed/spicedbGo	>= 1.15.0, < 1.52.0	1.52.0

Affected products

Authzed/SpicedbGHSA
Range: >= 1.15.0, < 1.52.0
ghsa-coords
pkg:golang/github.com/authzed/spicedb
Range: >= 1.15.0, < 1.52.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mqcf-gqvg-rmhmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46668ghsaADVISORY
github.com/authzed/spicedb/pull/3065nvdWEB
github.com/authzed/spicedb/releases/tag/v1.52.0nvdWEB
github.com/authzed/spicedb/security/advisories/GHSA-mqcf-gqvg-rmhmnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000