CVE-2026-40091

{
  "id": "CVE-2026-40091",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T04:17:46.360",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup \"configuration\" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error."
    },
    {
      "lang": "es",
      "value": "SpiceDB es un sistema de base de datos de código abierto para crear y gestionar permisos de aplicaciones críticos para la seguridad. En las versiones 1.49.0 a la 1.51.0, cuando SpiceDB se inicia con el nivel de registro info, el registro de inicio ’configuration’ incluirá el DSN completo del almacén de datos, incluyendo la contraseña en texto plano, dentro de DatastoreConfig.URI. Este problema ha sido solucionado en la versión 1.51.1. Si los usuarios no pueden actualizar inmediatamente, pueden solucionar este problema cambiando el nivel de registro a warn o error."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "authzed",
          "product": "spicedb",
          "versions": [
            {
              "version": ">= 1.49.0, < 1.51.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 4.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T13:23:09.983559Z",
          "id": "CVE-2026-40091",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:authzed:spicedb:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.49.0",
              "versionEndExcluding": "1.51.1",
              "matchCriteriaId": "34568987-D56A-46FA-8C8E-4DE942E9C494"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/authzed/spicedb/releases/tag/v1.51.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-jf4f-rr2c-9m58",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}