{"id":"CVE-2023-46255","aliases":["EUVD-2023-2760","GHSA-jg7w-cxjv-98c2","GO-2023-2166"],"status":"published","title":"`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00438,"percentile":0.38398,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2023-10-31T15:25:24Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Go","package":"github.com/authzed/spicedb","fixed_in":["1.27.0-rc1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-rc1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0-rc1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/authzed/spicedb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.0-rc1"}]}]}],"products":[{"vendor":"authzed","product":"spicedb"}],"references":[{"url":"https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46255","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jg7w-cxjv-98c2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46255.json","tags":["advisory"]},{"url":"https://github.com/authzed/spicedb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-46255","title":"`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.","status":"published","published":"2023-10-31T15:25:24.933Z","modified":"2024-09-05T20:16:15.166Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:35:23.645864Z"}],"euvd":[{"id":"EUVD-2023-2760","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.","status":"published","published":"2023-10-31T15:25:24Z","modified":"2024-09-05T20:16:15Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:56:02.678796Z"}],"ghsa":[{"id":"GHSA-jg7w-cxjv-98c2","title":"SpiceDB leaks information in log files when URI cannot be parsed","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.\n\nExample output:\n```\nterminated with errors error=\"unable to create migration driver for postgres: parse \\\"postgres://spicedb:\u003cPASSWORD IN PLAINTEXT\u003e\": invalid port \\\"\u003cPASSWORD IN PLAINTEXT\u003e\\\" after host\"\n```","status":"published","published":"2023-10-31T22:23:44Z","modified":"2023-11-03T15:41:56Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:11.48574Z"}],"nvd":[{"id":"CVE-2023-46255","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.","status":"published","published":"2023-10-31T16:15:10.007Z","modified":"2026-06-17T06:30:31.87Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-46255","title":"`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.","status":"published","published":"2023-10-31T15:25:24.933Z","modified":"2026-10-28T02:30:45.629687329Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"GHSA-jg7w-cxjv-98c2","title":"SpiceDB leaks information in log files when URI cannot be parsed","description":"SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. When the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.\n\nExample output:\n```\nterminated with errors error=\"unable to create migration driver for postgres: parse \\\"postgres://spicedb:\u003cPASSWORD IN PLAINTEXT\u003e\": invalid port \\\"\u003cPASSWORD IN PLAINTEXT\u003e\\\" after host\"\n```","status":"published","published":"2023-10-31T22:23:44Z","modified":"2026-09-10T03:49:58.688266354Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"GO-2023-2166","title":"SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb","description":"SpiceDB leaks information in log files when URI cannot be parsed in github.com/authzed/spicedb","status":"published","published":"2024-08-21T14:30:22Z","modified":"2026-02-04T03:09:37.421881Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}