MEDIUM🇵🇱 Wersja polska

CVE-2026-40091

CVSS 6.0v3.1pub. 2026-04-15upd. 2026-04-23

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

  • Authzed Spicedb

    APP
    Authzed
    1.49.0 – 1.51.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-27101HIGH7.3ten sam produkt

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical appli...

CVE-2023-29193HIGH8.7ten sam produkt

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critic...

CVE-2022-21646HIGH8.1ten sam produkt

SpiceDB is a database system for managing security-critical application permissions. Any user making use of a ...

CVE-2023-46255MEDIUM4.2ten sam produkt

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical appli...

CVE-2025-65111LOW2.9ten sam produkt

SpiceDB to open source'owy system bazy danych do tworzenia i zarządzania uprawnieniami krytycznymi dla bezpiec...