Spicedb
CVE-2023-29193
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 7.5 (HIGH). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required. |
| Exploit ScenarioDerived | This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the high-severity affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified under CWE-209. SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The /debug/pprof/cmdline endpoint served by the metrics service (defaulting running on port 9090) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1.
Impact All deployments abiding by the recommended best practices for production usage are NOT affected: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator Users configuring SpiceDB via environment variables are NOT affected. Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key via command-line flag.
Patches TODO
Workarounds To workaround this issue you can do one of the following: - Configure the preshared key via an environment variable (e.g. SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve) - Reconfigure the --metrics-addr flag to bind to a trusted network (e.g. --metrics-addr=localhost:9090) - Disable the metrics service via the flag (e.g. --metrics-enabled=false) - Adopt one of the recommended deployment models: Authzed's managed services or the SpiceDB Operator
References - GitHub Security Advisory issued for SpiceDB - Go issue #22085 for documenting the risks of exposing pprof to the internet - Go issue #42834 discusses preventing pprof registration to the default serve mux - semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure checks for a variation of this issue
Credit We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability. Affected products include: Authzed Spicedb. Version information: version 1.19.1..
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The /debug/pprof/cmdline endpoint served by the metrics service (defaulting running on port 9090) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1.
Impact
All deployments abiding by the recommended best practices for production usage are NOT affected:
- Authzed's SpiceDB Serverless
- Authzed's SpiceDB Dedicated
- SpiceDB Operator
Users configuring SpiceDB via environment variables are NOT affected.
Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key via command-line flag.
Patches
TODO
Workarounds
To workaround this issue you can do one of the following:
- Configure the preshared key via an environment variable (e.g.
SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve) - Reconfigure the
--metrics-addrflag to bind to a trusted network (e.g.--metrics-addr=localhost:9090) - Disable the metrics service via the flag (e.g.
--metrics-enabled=false) - Adopt one of the recommended deployment models: Authzed's managed services or the SpiceDB Operator
References
- GitHub Security Advisory issued for SpiceDB
- Go issue #22085 for documenting the risks of exposing pprof to the internet
- Go issue #42834 discusses preventing pprof registration to the default serve mux
- semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure checks for a variation of this issue
Credit
We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application per
spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical applica
SpiceDB is a graph database purpose-built for storing and evaluating access control data. Rated medium severity (CVSS 4.
A remote code execution vulnerability in SpiceDB (CVSS 3.7). Remediation should follow standard vulnerability management
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Rated low severity
SpiceDB is an open source database system for creating and managing security-critical application permissions. Rated low
Exploit-DB