CVE-2023-29193: Open Source Vulnerability in github.com/authzed/spicedb - SpiceDB binding metrics port can leak command-line flags
Summary
CVE-2023-29193: SpiceDB binding metrics port to untrusted networks and can leak command-line flags. Affects github.com/authzed/spicedb versions < 1.19.1. Fixed in 1.19.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/authzed/spicedb is an open-source package written in Go that provides a gRPC API for accessing and managing data in a SpiceDB database. It includes a command-line tool, spicedb serve, which starts the SpiceDB server and exposes a metrics service on port 9090. The metrics service provides information about the server's performance and usage. The --grpc-preshared-key flag is used to protect the gRPC API from unauthorized access. However, the metrics service endpoint /debug/pprof/cmdline can inadvertently expose the command-line flags, including the --grpc-preshared-key, if the metrics port is exposed to an untrusted network.
Vulnerability Detail
The vulnerability in github.com/authzed/spicedb allows an attacker to obtain sensitive information, such as the --grpc-preshared-key, by accessing the /debug/pprof/cmdline endpoint of the metrics service. This can lead to unauthorized access to the gRPC API and potential compromise of the SpiceDB server. The impact of this vulnerability depends on the deployment configuration, as deployments following recommended best practices are not affected. However, users who expose the metrics port to an untrusted network and configure the --grpc-preshared-key via a command-line flag may be at risk.
How To Fix
Latest published version: v1.57.0 as of 23 Oct 2026
go get github.com/authzed/spicedb@v1.57.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.1
This is the first release that contains the fix.
go get github.com/authzed/spicedb@v1.19.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, users can implement one of the following workarounds:
- Configure the preshared key via an environment variable:
SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve - Reconfigure the
--metrics-addrflag to bind to a trusted network:--metrics-addr=localhost:9090 - Disable the metrics service via the flag:
--metrics-enabled=false - Consider adopting one of the recommended deployment models, such as Authzed's managed services or the SpiceDB Operator.
Conclusion
The vulnerability in github.com/authzed/spicedb allows an attacker to obtain sensitive information by accessing the metrics service endpoint. To mitigate this vulnerability, users should upgrade to the latest version of github.com/authzed/spicedb and configure the --grpc-preshared-key via an environment variable. Alternatively, they can implement one of the provided workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/authzed/spicedb →
FAQ
github.com/authzed/spicedb is an open-source package written in Go that provides a gRPC API for accessing and managing data in a SpiceDB database. It includes a command-line tool, spicedb serve, which starts the SpiceDB server and exposes a metrics service on port 9090.
The --grpc-preshared-key flag is used to protect the gRPC API of the SpiceDB server from unauthorized access. It is a sensitive piece of information that should be kept secret.
The vulnerability occurs when the metrics service endpoint /debug/pprof/cmdline is accessed. This endpoint inadvertently exposes the command-line flags, including the --grpc-preshared-key, if the metrics port is exposed to an untrusted network.
Users who expose the metrics port of github.com/authzed/spicedb to an untrusted network and configure the --grpc-preshared-key via a command-line flag may be affected by this vulnerability. Deployments following recommended best practices are not affected.
The vulnerability can be fixed by upgrading to version 1.19.1 or later of github.com/authzed/spicedb. It is also recommended to configure the --grpc-preshared-key via an environment variable instead of a command-line flag.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/authzed/spicedb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
