GitHub Advisoryadvisory · Go

GHSA-jf4f-rr2c-9m58 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

MEDIUM Published 2026-04-14 Modified 2026-05-14 Official page ↗
Aliases
CVE-2026-40091
Ecosystem
Go
Packages
github.com/authzed/spicedb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2026-04-14

Affected packages

• Go github.com/authzed/spicedb: >= 1.49.0, < 1.51.1 → fixed in 1.51.1

Description

Impact When SpiceDB starts with log level `info`, the startup `"configuration"` log will include the full datastore DSN, including the plaintext password, inside `DatastoreConfig.URI`. Patches v1.51.1 Workarounds Change the log level to `warn` or `error`.

Related

Alias · CVE (1)

  • CVE-2026-40091 SpiceDB is an open source database system for creating and managing security-critical application permissions. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References