CVE-2026-55866: SpiceDB Authorization Bypass Vulnerability

CVE-2026-55866 Overview

CVE-2026-55866 is an authorization vulnerability [CWE-863] in SpiceDB, an open source database for managing security-critical application permissions. Versions 1.34.0 through 1.53.x can incorrectly return PERMISSIONSHIP_HAS_PERMISSION when the correct result should be PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION. The flaw resides in checkRequestToKey() and checkRequestToKeyWithCanonical() within internal/dispatch/keys/computed.go, which omit CheckHints when constructing dispatch check cache keys. A cached result from one hint set can poison entries used by semantically different authorization checks, granting permission without satisfying the required caveat. The issue is fixed in version 1.54.0.

Critical Impact
Under specific concurrent request patterns, an attacker can obtain permission for an operation that should have required a caveat to be satisfied, bypassing intended access controls.

Affected Products

SpiceDB versions 1.34.0 through 1.53.x
Deployments with dispatch result cache enabled
Schemas combining relations with intersection or exclusion operators

Discovery Timeline

2026-09-14 - CVE-2026-55866 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55866

Vulnerability Analysis

SpiceDB uses a dispatch cache to accelerate permission checks by memoizing intermediate DispatchCheckRequest results. The cache key is derived from properties of the request, including the resource relation, resource IDs, subject, and result settings. However, CheckHints — data that influences how a check resolves through caveated and non-caveated branches — was not incorporated into the key.

When a LookupResources call with a context parameter runs concurrently with CheckPermission or CheckBulkPermissions for the same resource and subject, the two operations can generate distinct hint sets that hash to identical cache keys. The first computed result populates the cache and is served to the second request. If the poisoning result grants permission, the caveat evaluation is effectively skipped, resulting in an incorrect authorization decision.

Root Cause

The root cause is incomplete cache key derivation in internal/dispatch/keys/computed.go. The functions checkRequestToKey() and checkRequestToKeyWithCanonical() hash only a subset of the request fields, treating requests with different CheckHints as equivalent. This violates the invariant that cache keys must uniquely represent the semantics of the check they memoize.

Attack Vector

Exploitation requires the target schema to combine relations using intersection or exclusion, a subject reachable through both caveated and non-caveated branches, concurrent LookupResources with context alongside CheckPermission or CheckBulkPermissions on the same resource and subject, and an enabled dispatch result cache. High attack complexity limits opportunistic exploitation, but a knowledgeable adversary with API access can arrange these conditions.

// checkRequestToKey converts a check request into a cache key based on the relation
func checkRequestToKey(req *v1.DispatchCheckRequest) DispatchCacheKey {
-	return dispatchCacheKeyHash(checkViaRelationPrefix, req.Metadata.AtRevision,
+	args := []hashableValue{
 		hashableRelationReference{req.ResourceRelation},
 		hashableIds(req.ResourceIds),
 		hashableOnr{req.Subject},
 		hashableResultSetting(req.ResultsSetting),
-	)
+	}
+
+	if len(req.CheckHints) > 0 {
+		args = append(args, hashableCheckHints(req.CheckHints))
+	}
+
+	return dispatchCacheKeyHash(checkViaRelationPrefix, req.Metadata.AtRevision, args...)
}
// Source: https://github.com/authzed/spicedb/commit/44a1c9f266bd8a884bfebfc27181210302541b9b

The patch appends a hashableCheckHints(req.CheckHints) value to the hash inputs whenever hints are present, ensuring semantically distinct requests receive distinct cache keys.

Detection Methods for CVE-2026-55866

Indicators of Compromise

Authorization decisions that grant access on resources protected by caveats without corresponding caveat context in request logs.
Correlated bursts of LookupResources calls carrying a context parameter overlapping with CheckPermission or CheckBulkPermissions on the same subject-resource pair.
Application-side audit logs showing unexpected HAS_PERMISSION results for permissions defined with intersection or exclusion.

Detection Strategies

Inventory SpiceDB deployments and identify any instance running versions 1.34.0 through 1.53.x with the dispatch result cache enabled.
Review permission schemas for use of intersection (&) and exclusion (-) operators combined with caveated relations.
Add integration tests that replay the concurrent LookupResources/CheckPermission pattern to observe whether the returned permissionship matches the expected caveated result.

Monitoring Recommendations

Enable structured logging of dispatch cache hits and misses to detect anomalies in check outcomes for caveated permissions.
Emit metrics on the ratio of CONDITIONAL_PERMISSION to HAS_PERMISSION results and alert on unexpected shifts after deployment changes.
Forward SpiceDB access logs to a central analytics platform for correlation with downstream application authorization events.

How to Mitigate CVE-2026-55866

Immediate Actions Required

Upgrade SpiceDB to version 1.54.0 or later, which includes the fix in checkRequestToKey() and checkRequestToKeyWithCanonical().
Audit recent authorization decisions on resources governed by caveated permissions to identify any incorrectly granted access.
Restrict API access to trusted service principals until upgrade is complete.

Patch Information

The fix is included in SpiceDB v1.54.0 via Pull Request #3188 and commits 44a1c9f and ccde792f. Full details are documented in GitHub Security Advisory GHSA-4vrg-r928-h5vv.

Workarounds

Disable the dispatch result cache until the upgrade to 1.54.0 can be deployed, accepting the associated performance cost.
Avoid issuing LookupResources calls with context concurrently with CheckPermission or CheckBulkPermissions for the same subject-resource pair.
Refactor affected schemas to reduce reliance on intersection or exclusion combined with caveated relations where feasible.

bash

# Upgrade SpiceDB to the patched release
docker pull authzed/spicedb:v1.54.0

# Verify the running version after deployment
spicedb version