CVE-2023-29193: SpiceDB binding metrics port leakage in github.com/authzed/spicedb
Summary
CVE-2023-29193: SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb. Affects github.com/authzed/spicedb versions < 1.19.1. Fixed in 1.19.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/authzed/spicedb, an open-source Go library. SpiceDB is a database that provides a flexible and scalable authorization system. It allows developers to define complex permission models and efficiently query them. The library is widely used in various applications to manage authorization and access control. However, a vulnerability has been discovered in the library that can lead to the leakage of command-line flags and binding metrics port to untrusted networks.
Vulnerability Detail
The vulnerability in github.com/authzed/spicedb allows an attacker to potentially access sensitive information by exploiting the binding metrics port. This port is bound to untrusted networks, making it susceptible to unauthorized access. Additionally, the library may inadvertently leak command-line flags, which could expose sensitive configuration details. This vulnerability poses a risk to the confidentiality and integrity of the system, as an attacker could gain unauthorized access or obtain sensitive information.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.19.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by implementing network-level access controls to restrict access to the binding metrics port. Additionally, it is advisable to review and remove any sensitive information from command-line flags to prevent leakage.
Conclusion
The vulnerability in github.com/authzed/spicedb allows for potential unauthorized access and leakage of sensitive information. It is crucial for developers to upgrade to version 1.19.1 or later to fix the vulnerability. Implementing network-level access controls and reviewing command-line flags can further mitigate the risk. Regularly monitoring for updates and applying patches is essential to maintain the security of applications using this library.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
The vulnerability can lead to unauthorized access and potential leakage of sensitive information, compromising the confidentiality and integrity of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, versions 0 through 1.19.0 are affected. The vulnerability has been fixed in version 1.19.1 and later.
Yes, the vulnerability has been patched in version 1.19.1 of github.com/authzed/spicedb. It is recommended to upgrade to this version or later to fix the vulnerability.
If you cannot immediately upgrade to the latest version, you should implement network-level access controls to restrict access to the binding metrics port. Additionally, review and remove any sensitive information from command-line flags to mitigate the risk of leakage.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
