CVE-2026-40091
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
SpiceDB versions 1.49.0 through 1.51.0, when started with log level info, write the full datastore DSN including the plaintext password into the startup configuration log inside DatastoreConfig.URI. The issue is fixed in version 1.51.1.
Risk Assessment
The database password may leak into logs accessible to unauthorized parties, risking unauthorized access to the datastore.
Recommendation
Upgrade SpiceDB to version 1.51.1. If immediate upgrade is not possible, change the log level to warn or error.
Other vulnerabilities in SpiceDB
See all- CVE-2026-55866Low
SpiceDB from 1.34.0 until 1.54.0 can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. A result computed for one hint set can poison the cache entry used by a semantically different authorization check.
- CVE-2026-46668Low
In SpiceDB from version 1.15.0 to before 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
- CVE-2025-65111Medium
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.
- CVE-2023-35930Low
SpiceDB, a Google Zanzibar-inspired database system, has an issue with negative authorization decisions using the `LookupResources` request in version 1.22.0. Users may incorrectly gain access to resources that should be blocked.
Original NVD description (English source)
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS