CVE-2023-46255 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed

What is CVE-2023-46255?

CVE-2023-46255 is a medium-severity vulnerability in authzed spicedb, published on 31 Oct 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.

Weakness: CWE-532

Which versions are affected by CVE-2023-46255?

3 open source packages ship an affected version, including github.com/authzed/spicedb. It affects 1 product.

Products include Authzed Spicedb.

How do I fix CVE-2023-46255?

Upgrade github.com/authzed/spicedb to 1.27.0-rc1 or later.

Is CVE-2023-46255 being exploited?

There is no known exploitation of CVE-2023-46255 in the wild and no public exploit code.

Other vulnerabilities in authzed spicedb

• CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags High 8.7
• CVE-2022-21646 Lookup operations do not take into account wildcards in SpiceDB High 8.1
• CVE-2024-27101 Integer overflow in chunking helper causes dispatching to miss elements or panic High 7.3
• CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs Medium 6.0
• CVE-2025-49011 SpiceDB checks involving relations with caveats can result in no permission when permission is expected Low 3.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jg7w-cxjv-98c2, GO-2023-2166.