6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40091

CVE-2026-40091: SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

Impact

When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI.

Patches

v1.51.1

Workarounds

Change the log level to warn or error.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40091

CVE-2026-40091:

6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/authzed/spicedb	go	>= 1.49.0, <= 1.51.0	1.51.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the application's startup logging. When SpiceDB starts with the default log level of info, it logs its entire configuration for debugging and auditing purposes. The function responsible for generating this configuration output is pkg/cmd/server.Config.DebugMap. Before the patch, this function would serialize the entire DatastoreConfig object, including the URI field which contains the full database connection string with credentials, without any redaction. This resulted in sensitive credentials being written to the startup logs.

The patch addresses this by modifying the DebugMap functions. Specifically, pkg/cmd/server.Config.DebugMap was updated to recursively call the DebugMap method of the nested DatastoreConfig object, instead of including the raw object. The pkg/cmd/datastore.Config.DebugMap function, in turn, ensures that the URI field is replaced with the string "(sensitive)".

An attacker with access to the logs (e.g., a local user, or access to a log aggregation system) could retrieve the database credentials, leading to a full compromise of the database. The vulnerable functions are the DebugMap methods that were modified to implement this redaction.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.