Sensitive information stored in logs In github.com/authzed/spicedb
Description
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs
Impact
When SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside DatastoreConfig.URI.
Patches
v1.51.1
Workarounds
Change the log level to warn or error.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.51.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.