TI-2024-32606 Aliases CVE-2024-48909 GHSA-3c32-4hq9-6wgj

SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not

LOW 12CWE-172Published 2024-10-14 · Updated 2024-10-15

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00319 25th percentileScored 2026-11-07

Fix Fixed spicedb (authzed): 1.37.1github.com/authzed/spicedb (Go): 1.37.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
authzed	spicedb	1.35.0 to before 1.37.1	1.37.1	Patch available	CNA
—	github.com/authzed/spicedb (Go)	1.35.0 to before 1.37.1	1.37.1	Patch available	GHSA-3c32-4hq9-6wgj

spicedb Vendorauthzed Affected 1.35.0 to before 1.37.1 Fixed in 1.37.1 Patch available CNA
github.com/authzed/spicedb (Go) Vendor— Affected 1.35.0 to before 1.37.1 Fixed in 1.37.1 Patch available GHSA-3c32-4hq9-6wgj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:authzed:spicedb::::::::	1.35.0 to before 1.37.1	Vulnerable	authzed

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:* Versions 1.35.0 to before 1.37.1 Vulnerable ·authzed

Remediation

Fix · CNA spicedb (authzed) Fixed in 1.37.1
Fix · GHSA-3c32-4hq9-6wgj github.com/authzed/spicedb (Go) Fixed in 1.37.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2024-48909
2026-10-03 Alias added: GHSA-3c32-4hq9-6wgj

References

Patch 1

https://github.com/authzed/spicedb/commit/2f3cf77a7fcfcb478ef5a480a245842c96ac8853

Advisory 2

Other 1

https://github.com/authzed/spicedb

TI-2025-31139 SpiceDB checks involving relations with caveats can result in no permission when permission is expected CVSS 3.1MEDIUM 5.3
TI-2023-13621 SpiceDB binding metrics port to untrusted networks and can leak command-line flags CVSS 3.1HIGH 8.7
TI-2024-17962 Integer overflow in chunking helper causes dispatching to miss elements or panic CVSS 3.1CRITICAL 9.1
TI-2022-06024 Lookup operations do not take into account wildcards in SpiceDB CVSS 3.1HIGH 8.1
TI-2023-24882 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed CVSS 3.1MEDIUM 6.5
TI-2026-28919 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CVSS 3.1MEDIUM 6.0

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences