SpiceDB is an open source database system for creating and managing security-critical application permissions.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 15, 2026 · NIST NVD

   Detected

   SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately up

2. Jun 17, 2026 · NIST NVD

   Updated

   SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI. This issue has been fixed in version 1.51.1. If users are unable to immediately up

Affected

• cpe authzed/spicedbversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40091

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40091

  SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · github.com