CVE-2023-46255— `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
Quick assessment
Affected
authzed spicedb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SpiceDB是受 Google Zanzibar 启发的细粒度权限数据库。 SpiceDB 1.27.0 之前版本存在日志信息泄露漏洞，该漏洞源于当 URI 无法解析时，SPICEDB_DATASTORE_CONN_URI`就会泄漏，在日志中显示密码。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-46255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
Source: CVE Program / CVE List V5
Vulnerability Description
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
SpiceDB 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SpiceDB是受 Google Zanzibar 启发的细粒度权限数据库。 SpiceDB 1.27.0 之前版本存在日志信息泄露漏洞，该漏洞源于当 URI 无法解析时，SPICEDB_DATASTORE_CONN_URI`就会泄漏，在日志中显示密码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-46255
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-46255
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-46255 (1)
Vendor Advisories for CVE-2023-46255 (1)
-
https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: spicedb
-
CVE-2026-55866
SpiceDBChecks involving relations with caveats can result in -
CVE-2026-46668
SpiceDB: Caveat structures with nested lists can result in i -
CVE-2026-40091
SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup log -
CVE-2025-65111
SpiceDB's LookupResources with Multiple Entrypoints across D -
CVE-2025-64529
SpiceDB's WriteRelationships fails silently if payload is to
Same vendor: authzed
-
CVE-2026-55866
SpiceDBChecks involving relations with caveats can result in -
CVE-2026-46668
SpiceDB: Caveat structures with nested lists can result in i -
CVE-2026-40091
SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup log -
CVE-2025-65111
SpiceDB's LookupResources with Multiple Entrypoints across D -
CVE-2025-64529
SpiceDB's WriteRelationships fails silently if payload is to
Same weakness: CWE-532
-
CVE-2026-101168
Insertion of Sensitive Information into Log File in GitLab -
CVE-2023-54407
Frappe 14.x before 14.45.0 Information Disclosure via Error -
CVE-2026-85961
Sensitive information exposure in Progress MarkLogic Server -
CVE-2026-85949
Sensitive information exposure in Progress MarkLogic Server -
CVE-2026-108858
Predibase LoRAX through 0.12.1 API Token Exposure via Router
V. Comments for CVE-2023-46255
No comments yet