CVE-2026-40091

BRIEFING NOTE: CVE-2026-40091 SpiceDB, an open source permission management database, contains an information disclosure vulnerability in versions 1.49.0 through 1.51.1 where startup configuration logs expose plaintext database passwords when the application starts with info-level logging enabled. This affects organizations using affected versions of SpiceDB in production environments where logs are aggregated or retained. The vulnerability presents a medium severity risk (CVSS 6.0) requiring local access and high privileges to exploit, but results in full confidentiality compromise of database credentials with no impact on integrity or availability. The attack vector is local, complexity is low, and the privileged attacker can access sensitive authentication data that could facilitate lateral movement or unauthorized database access. There is no evidence of active exploitation in the wild, no public exploit code is available, and this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. The extremely low EPSS score (0.00012) indicates minimal real-world exploitation probability. Patching to version 1.51.1 is recommended, with an interim mitigation of adjusting log levels to warn or error severity.