CVE-2026-40091: SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.

CVE-2026-40091 · Severity: medium · CVSS 6 · Published 2026-04-15

SpiceDB, a database used for managing application permissions, may inadvertently leak sensitive database credentials in its system logs. When the application starts with standard logging enabled, it writes the full connection string—including plaintext passwords—to the log files. An attacker with access to these logs could use the credentials to gain unauthorized access to the underlying data store, potentially leading to data theft or service disruption.

Technologies: Authzed SpiceDB, github.com/authzed/spicedb (Go). Vendors: Authzed, Go.

Quick answers

Is CVE-2026-40091 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40091 being exploited in the wild.
How severe is CVE-2026-40091?
Medium severity, with a CVSS score of 6, published 15 April 2026.
Which products and versions are affected?
Authzed SpiceDB >= 1.49.0, <= 1.51.0; github.com/authzed/spicedb (Go) >= 1.49.0, <= 1.51.0, SEMVER:introduced=1.49.0,fixed=1.51.1.
Is there a fix for CVE-2026-40091?
Yes. github.com/authzed/spicedb (Go): upgrade to 1.51.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40091 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-40091?
Check whether you run Authzed SpiceDB or github.com/authzed/spicedb (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/authzed/spicedb (Go): upgrade to 1.51.1 or later
    go get github.com/authzed/spicedb@v1.51.1

Technical details

SpiceDB versions 1.49.0 through 1.51.0 contain a sensitive information leak (CWE-532) in the startup logging routine. When the log level is set to 'info', the 'configuration' log entry includes the full DatastoreConfig.URI, which contains the Data Source Name (DSN) and any associated plaintext passwords. This vulnerability requires local access to the log files or access to a log aggregation service. An attacker with sufficient privileges to read these logs can extract database credentials to compromise the backend datastore. The issue is resolved in version 1.51.1; a temporary workaround is to set the log level to 'warn' or 'error'.

Affected products

  • Authzed SpiceDB >= 1.49.0, <= 1.51.0

Identifiers

  • CVE-2026-40091
  • GHSA-jf4f-rr2c-9m58
  • GO-2026-5465

Timeline

  • 2026-04-14: disclosed
  • 2026-04-14: advisory
  • 2026-04-14: patched: v1.51.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.