Context Missing Vulnerability in SpiceDB: LookupResources2 Caveat Issue
Summary
CVE-2024-48909: SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb. Affects github.com/authzed/spicedb versions >= 1.35.0, < 1.37.1. Fixed in 1.37.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SpiceDB is an open-source database designed for managing permissions and authorizations in applications. It allows developers to define and enforce complex access control rules using a rich set of features. However, a recent vulnerability has been identified in the LookupResources function, specifically when using the LookupResources2 method with caveats. This issue can lead to unexpected behavior in applications relying on SpiceDB for access control.
Vulnerability Detail
The vulnerability arises from SpiceDB's implementation of the LookupResources2 function, which may return a 'context is missing' error even when the context is present. This can occur when the function is called with caveats in versions prior to 1.37.1. The ramifications of this issue include potential access control failures, where users may be incorrectly denied or granted permissions, leading to security risks in applications that depend on accurate authorization checks.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.37.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.37.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the LookupResources2 function with caveats until you are able to update to the patched version. Alternatively, ensure that your application handles the 'context is missing' error gracefully, possibly by implementing fallback logic or logging the error for further investigation.
Conclusion
In summary, the vulnerability in SpiceDB's LookupResources2 function can lead to incorrect access control decisions due to misleading error messages. It is crucial for developers using this package to update to version 1.37.1 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability involves the LookupResources2 function returning a misleading error message regarding context, which can affect access control decisions.
Versions of SpiceDB from 1.35.0 up to, but not including, 1.37.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider implementing a workaround by avoiding the use of LookupResources2 with caveats and handling errors appropriately.
More information can be found in the vulnerability database at https://pkg.go.dev/vuln/GO-2024-3200.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
