8.7 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
0.001 Low
EPSS
Percentile
49.6%
The spicedb serve
command contains a flag named --grpc-preshared-key
which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.
The /debug/pprof/cmdline
endpoint served by the metrics service (defaulting running on port 9090
) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key
then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary.
All deployments abiding by the recommended best practices for production usage are NOT affected:
Users configuring SpiceDB via environment variables are NOT affected.
Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key
via command-line flag.
To workaround this issue you can do one of the following:
SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve
)--metrics-addr
flag to bind to a trusted network (e.g. --metrics-addr=localhost:9090
)--metrics-enabled=false
)CPE | Name | Operator | Version |
---|---|---|---|
github.com/authzed/spicedb | lt | 1.19.1 |