CVE-2022-21646 Lookup operations do not take into account wildcards in SpiceDB
Attackers can bypass permission checks in SpiceDB when wildcards are used in exclusions or intersections, gaining unauthorized access to resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21646?
CVE-2022-21646 is a high-severity vulnerability in authzed spicedb, published on 11 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
Which versions are affected by CVE-2022-21646?
3 open source packages ship an affected version, including github.com/authzed/spicedb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/authzed/spicedb Go | From 1.3.0 | 1.4.0 |
github.com/authzed/spicedb Go | From 1.3.0 | 1.4.0 |
github.com/authzed/spicedb Go | From 1.3.0 | 1.4.0 |
Products include Authzed Spicedb.
How do I fix CVE-2022-21646?
Upgrade github.com/authzed/spicedb to 1.4.0 or later.
Is CVE-2022-21646 being exploited?
There is no known exploitation of CVE-2022-21646 in the wild and no public exploit code.
Other vulnerabilities in authzed spicedb
- CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags
- CVE-2024-27101 Integer overflow in chunking helper causes dispatching to miss elements or panic
- CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
- CVE-2023-46255 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
- CVE-2025-49011 SpiceDB checks involving relations with caveats can result in no permission when permission is expected
Sources
Also known as GHSA-7p8f-8hjm-wm92, GO-2022-0295.