CVE-2023-46255

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.

• CWE-532

• https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8Patch
• https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2Vendor Advisory
• https://github.com/authzed/spicedb/commit/ae50421b80f895e4c98d999b18e06b6f1e6f1cf8Patch
• https://github.com/authzed/spicedb/security/advisories/GHSA-jg7w-cxjv-98c2Vendor Advisory

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4625Improper Restriction of Excessive Authentication Attempts vu…5.3
• CVE-2023-46250pypdf is a free and open-source pure-python PDF library. An …5.5
• CVE-2023-46251 MyBB is a free and open source forum software. Custom MyCod…6.1
• CVE-2023-46252Squidex is an open source headless CMS and content managemen…6.1
• CVE-2023-46253Squidex is an open source headless CMS and content managemen…7.2
• CVE-2023-46254capsule-proxy is a reverse proxy for Capsule kubernetes mult…4.3
• CVE-2023-46256PX4-Autopilot provides PX4 flight control solution for drone…9.8
• CVE-2023-46257An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46258An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-46259An attacker sending specially crafted data packets to the Mo…9.8
• CVE-2023-4626The LadiApp plugin for WordPress is vulnerable to unauthoriz…4.3
• CVE-2023-46260An attacker sending specially crafted data packets to the Mo…9.8