CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...

CVE-2026-40091

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...

GHSA-JF4F-RR2C-9M58 SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

Impact When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. Patches v1.51.1 Workarounds Change the log level to warn or error...

SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

Impact When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. Patches v1.51.1 Workarounds Change the log level to warn or error...

EUVD-2026-22815

SpiceDB's SPICEDBDATASTORECONNURI is leaked on startup logs...

PT-2026-32969

Name of the Vulnerable Software and Affected Versions SpiceDB versions 1.49.0 through 1.51.0 Description When the system starts with the log level set to info, the startup 'configuration' log exposes the full datastore DSN, including the plaintext password, within the DatastoreConfig.URI variable...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kserve-rest-proxy, cluster-proportional-autoscaler, helm-set-status, otel-cli, aws-node-termination-handler, envoy-ratelimit, ghaudit, kubernetes-csi-external-attacher, openbao, juicefs-csi-driver, keda, terraform-provider-azapi,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: otel-cli, podinfo, crossplane-provider-aws-kms, aws-node-termination-handler, chartmuseum, crossplane-provider-aws-rds, crossplane-provider-aws-sqs, crossplane-provider-aws-eks, distribution, docker-compose, envoy-ratelimit, gomplate, knative-serving,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, docker-compose, crossplane-provider-azure-notificationhubs, gitlab-runner-fips, pulumi-language-yaml, crossplane-provider-aws-secretsmanager-fips, bank-vaults, cass-operator-fips, aws-node-termination-handler, cluster-api-provider-vsphere,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, docker-compose, crossplane-provider-azure-notificationhubs, gitlab-runner-fips, pulumi-language-yaml, crossplane-provider-aws-secretsmanager-fips, bank-vaults, cass-operator-fips, aws-node-termination-handler, cluster-api-provider-vsphere,...

Improper Authorization

github.com/authzed/spicedb is vulnerable to Improper Authorization. The vulnerability is due to incorrect handling of permission unions referencing the same relation in the LookupResources API, which allows an attacker to bypass expected permission checks by causing incomplete or missing...

Information Disclosure

github.com/authzed/spicedb is vulnerable to Information Disclosure. The vulnerability is due to the exclusion operator in the authorization schema, where a large payload can cause the WriteRelationships call to fail silently, and incorrect permission check results are returned, allowing attackers...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-fips, witness, goose-fips, openfga, mattermost, sftpgo-plugin-eventstore, gitea, kyverno-fips, caddy, db-operator, temporal, ratify, rke2-runtime, sqlexporter, k3s, trufflehog, beats, flux-kustomize-controller-fips, ksops, agentbeat, loki-fips...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: dbmate, loki, rekor, dgraph, telegraf, kubeflow-pipelines, minio, terragrunt, seaweedfs, temporal-server, spire-server, sqlexporter, mariadb-operator, caddy, mattermost, kots, openbao, croc, openfga, gitea, argo-workflows, flux-kustomize-controller, fulcio,...

GO-2026-4465 LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb

LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic in github.com/authzed/spicedb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GHSA-VHVQ-FV9F-WH4Q vulnerabilities

Vulnerabilities for packages: spicedb...

GHSA-VHVQ-FV9F-WH4Q vulnerabilities

Vulnerabilities for packages: spicedb-fips, spicedb...

LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

Description A malformed or tampered-with LookupResources Cursor token can cause a panic in the SpiceDB process if it fails to parse. If an attacker were able to make requests to a SpiceDB instance, they could affect its availability. Reproduction If one was to take a cursor from a LookupResources...

CVE-2025-65111

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union + and that union references the same relation on both sides but one si...

GO-2025-4151 SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb

SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results in github.com/authzed/spicedb...