LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

1.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Description A malformed or tampered-with LookupResources Cursor token can cause a panic in the SpiceDB process if it fails to parse. If an attacker were able to make requests to a SpiceDB instance, they could affect its availability. Reproduction If one was to take a cursor from a LookupResources call, decode it according to the logic that SpiceDB uses, and modify the Sections field to include an invalid relationship string, the process will panic. Impact An attacker would need both the ability to create a gRPC connection to your SpiceDB instance and a valid token, or else the ability to pass a cursor token from outside your application through to your SpiceDB instance. If an attacker had this ability, they could bring down SpiceDB instances, reducing the availability of SpiceDB and any service that depends on it. Mechanism The SpiceDB process does not validate the contents of this Sections component of the Cursor message. In affected versions, it uses a parsing function that calls…

Published by the source

6 Feb 2026, 22:30 UTC

Last modified by the source

6 Feb 2026, 22:30 UTC

Source last checked

26 Oct 2026, 15:14 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vhvq-fv9f-wh4q

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-vhvq-fv9f-wh4q

Advisory: LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic
IDs: GHSA-vhvq-fv9f-wh4q
Record: https://patchnext.com/advisories/ghsa-vhvq-fv9f-wh4q (revision 1, source checked 26 Oct 2026, 15:14 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 1.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/authzed/spicedb 1.49.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/authzed/spicedb: affected >= 1.29.3, < 1.49.1; fixed in 1.49.1

## Suggested inspection (read-only)
- Go github.com/authzed/spicedb: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/authzed/spicedb.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vhvq-fv9f-wh4q (GitHub-reviewed advisory GHSA-vhvq-fv9f-wh4q lists affected ranges: Go github.com/authzed/spicedb >=1.29.3 <1.49.1)

Commands are suggestions: review each one before running it.