CVE-2026-40091: SpiceDB DataStore Connection URI Leakage in Startup Logs
Summary
CVE-2026-40091: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs. Affects github.com/authzed/spicedb versions >= 1.49.0, < 1.51.1. Fixed in 1.51.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SpiceDB is an open-source database designed for managing permissions and authorization in applications. It provides a flexible and scalable way to handle complex access control scenarios. However, a recent vulnerability has been identified that exposes sensitive information during the startup process, specifically the DataStore Connection URI, which may include plaintext passwords.
Vulnerability Detail
The vulnerability arises when SpiceDB is started with the log level set to 'info'. In this mode, the startup logs include a configuration log that reveals the full DataStore Connection URI, which can contain sensitive information such as plaintext passwords. This leakage can lead to unauthorized access to the database if an attacker gains access to the logs, posing a significant security risk.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.51.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.51.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, change the logging level to 'warn' or 'error' to prevent the DataStore Connection URI from being logged. This can be done by modifying the configuration file or startup command to set the log level appropriately.
Conclusion
The CVE-2026-40091 vulnerability in SpiceDB poses a risk by leaking sensitive DataStore Connection URI information in startup logs. It is crucial to update to version 1.51.1 or later to mitigate this risk. Additionally, changing the log level can serve as a temporary workaround while updates are being applied.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability can lead to the exposure of sensitive information, such as plaintext passwords, in the startup logs, potentially allowing unauthorized access to the database.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions of SpiceDB from 1.49.0 up to and including 1.51.0 are affected by this vulnerability.
If you cannot update immediately, ensure to change the log level to 'warn' or 'error' to mitigate the risk of exposing sensitive information in the logs.
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
