CVE-2026-40091
published 2026-04-15CVE-2026-40091: SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB…
PriorityP419medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.17%
6.2th percentile
SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| authzed | spicedb | — | — |
| authzed | spicedb | >= 1.49.0 < 1.51.1 | 1.51.1 |
| github.com | authzed_spicedb | >= 1.49.0 < 1.51.1 | 1.51.1 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
vendor_redhat·2026-04-14·CVSS 6.0
CVE-2026-40091 [MEDIUM] CWE-532 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
A flaw was found in SpiceDB. When SpiceDB starts with log level `info`, the startup configuration log will expose the full datastore Data Source Name (DSN), including the plaintext password. This vulnerability allows an attacker with access to these logs to obtain sensitive database credentials, potentially leading to unauthorized access to the datastore.
Statement: To exploit this vulnerability, a local attacker needs to have read access to the startup configuration log. Due to this reason, this flaw has been rated with a moderate severity.
Mitigation: To mitigate this flaw, configure the log level to 'warn' or 'error', instead of 'info'.
Package: multicluster-globalhub/multicluster-globalhub-agent-rhel9 (Multicluster Globa
GHSA
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
ghsa·2026-04-14
CVE-2026-40091 [MEDIUM] CWE-532 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
### Impact
When SpiceDB starts with log level `info`, the startup `"configuration"` log will include the full datastore DSN, including the plaintext password, inside `DatastoreConfig.URI`.
### Patches
v1.51.1
### Workarounds
Change the log level to `warn` or `error`.
No detection rules found.
No public exploits indexed.
2026-04-15
Published