CVE-2026-40091 PUBLISHED

SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

Assigner: GitHub_M
Reserved: 09.04.2026 Published: 14.04.2026 Updated: 15.04.2026

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 6

Product Status

Vendor authzed
Product spicedb
Versions
  • Version >= 1.49.0, < 1.51.1 is affected

References

Problem Types

  • CWE-532: Insertion of Sensitive Information into Log File CWE