CVE-2026-40091

Опубликовано: 14 апр. 2026

Источник: redhat

CVSS3: 4.4

EPSS Низкий

Описание

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately upgrade, they can work around this issue by changing the log level to warn or error.

A flaw was found in SpiceDB. When SpiceDB starts with log level info, the startup configuration log will expose the full datastore Data Source Name (DSN), including the plaintext password. This vulnerability allows an attacker with access to these logs to obtain sensitive database credentials, potentially leading to unauthorized access to the datastore.

Отчет

To exploit this vulnerability, a local attacker needs to have read access to the startup configuration log. Due to this reason, this flaw has been rated with a moderate severity.

Меры по смягчению последствий

To mitigate this flaw, configure the log level to 'warn' or 'error', instead of 'info'.

Затронутые пакеты

Платформа	Пакет	Состояние
Multicluster Global Hub	multicluster-globalhub/multicluster-globalhub-agent-rhel9	Not affected
Multicluster Global Hub	multicluster-globalhub/multicluster-globalhub-manager-rhel9	Not affected
Multicluster Global Hub	multicluster-globalhub/multicluster-globalhub-rhel9-operator	Not affected

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Moderate

Дефект:

CWE-532

https://bugzilla.redhat.com/show_bug.cgi?id=2458577SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs

EPSS

Процентиль: 6%

0.00166

Низкий

4.4 Medium

CVSS3

Связанные уязвимости

CVE-2026-40091

CVSS3: 6

nvd

4 месяца назад

GHSA-jf4f-rr2c-9m58