CVE-2026-40091

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/authzed/spicedb/releases/tag/v1.51.1	Product Release Notes
https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*

History

23 Apr 2026, 17:15

Type	Values Removed	Values Added
References	~~() https://github.com/authzed/spicedb/releases/tag/v1.51.1 -~~	() https://github.com/authzed/spicedb/releases/tag/v1.51.1 - Product, Release Notes
References	~~() https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58 -~~	() https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58 - Vendor Advisory
First Time		Authzed spicedb Authzed
CPE		cpe:2.3:a:authzed:spicedb::::::::

15 Apr 2026, 04:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-15 04:17

Updated : 2026-06-17 10:44

NVD link : CVE-2026-40091

Mitre link : CVE-2026-40091

CVE.ORG link : CVE-2026-40091

JSON object : View

Products Affected

authzed

spicedb

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-40091", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40091", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T13:23:09.983559Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "authzed", "product": "spicedb", "versions": [{"status": "affected", "version": ">= 1.49.0, < 1.51.1"}]}]}], "published": "2026-04-15T04:17:46.360", "references": [{"url": "https://github.com/authzed/spicedb/releases/tag/v1.51.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup \"configuration\" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error."}], "lastModified": "2026-06-17T10:44:42.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34568987-D56A-46FA-8C8E-4DE942E9C494", "versionEndExcluding": "1.51.1", "versionStartIncluding": "1.49.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}