CVE-2026-40091

Katalog CVE

CVSS 4.4 · Medium EPSS 0,18%

Kerentanan Insertion of Sensitive Information into Log File pada authzed spicedb. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58 advisory vendor
• https://github.com/authzed/spicedb/releases/tag/v1.51.1 product · release notes