authzed/spicedb · Security
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
- GHSA ID
- GHSA-jf4f-rr2c-9m58
- CVE ID
- CVE-2026-40091
- Severity
- medium
- Published
- Updated
- CVSS
- 6 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- CVSS v3
- 6 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Description
Impact
When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI.
Patches
v1.51.1
Workarounds
Change the log level to warn or error.
CWEs
- CWE-532 · Insertion of Sensitive Information into Log File