tocsin

Go/github.com/authzed/spicedb CVE-2026-55866: unknown, EPSS 0.34%

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected in github.com/authzed/spicedb

Action: Upgrade github.com/authzed/spicedb to 1.54.0 or later.

go get github.com/authzed/spicedb@v1.54.0

Affected

introducedfixedlast affected
1.34.01.54.0-

Fixed versions

1.54.0

Sources

CVE-2026-55866 · published · modified · JSON