CVE-2026-40091

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/authzed/spicedb/releases/tag/v1.51.1	Product Release Notes
https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) SpiceDB es un sistema de base de datos de código abierto para crear y gestionar permisos de aplicaciones críticos para la seguridad. En las versiones 1.49.0 a la 1.51.0, cuando SpiceDB se inicia con el nivel de registro info, el registro de inicio ’configuration’ incluirá el DSN completo del almacén de datos, incluyendo la contraseña en texto plano, dentro de DatastoreConfig.URI. Este problema ha sido solucionado en la versión 1.51.1. Si los usuarios no pueden actualizar inmediatamente, pueden solucionar este problema cambiando el nivel de registro a warn o error.

Information

Published : 2026-04-15 04:17

Updated : 2026-10-26 22:10

NVD link : CVE-2026-40091

Mitre link : CVE-2026-40091

CVE.ORG link : CVE-2026-40091

JSON object : View

Products Affected

authzed

spicedb

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-40091", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40091", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:23:09.983559Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "authzed", "product": "spicedb", "versions": [{"status": "affected", "version": ">= 1.49.0, < 1.51.1"}]}]}], "published": "2026-04-15T04:17:46.360", "references": [{"url": "https://github.com/authzed/spicedb/releases/tag/v1.51.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup \"configuration\" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error."}, {"lang": "es", "value": "SpiceDB es un sistema de base de datos de c\u00f3digo abierto para crear y gestionar permisos de aplicaciones cr\u00edticos para la seguridad. En las versiones 1.49.0 a la 1.51.0, cuando SpiceDB se inicia con el nivel de registro info, el registro de inicio \u2019configuration\u2019 incluir\u00e1 el DSN completo del almac\u00e9n de datos, incluyendo la contrase\u00f1a en texto plano, dentro de DatastoreConfig.URI. Este problema ha sido solucionado en la versi\u00f3n 1.51.1. Si los usuarios no pueden actualizar inmediatamente, pueden solucionar este problema cambiando el nivel de registro a warn o error."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34568987-D56A-46FA-8C8E-4DE942E9C494", "versionEndExcluding": "1.51.1", "versionStartIncluding": "1.49.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}