Cyber Resilience

CVE-2023-29193

Info Disclosure in Authzed Spicedb ≤ 1.19.1

Published
14 April 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0076 52th percentile
Risk Priority 61 floored blend · peak EPSS

Summary

CVE-2023-29193 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Authzed Spicedb. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Software (T1592.002); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The…

more

values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1. ### Impact All deployments abiding by the recommended best practices for production usage are **NOT affected**: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator Users configuring SpiceDB via environment variables are **NOT affected**. Users **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag. ### Patches TODO ### Workarounds To workaround this issue you can do one of the following: - Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`) - Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`) - Disable the metrics service via the flag (e.g. `--metrics-enabled=false`) - Adopt one of the recommended deployment models: [Authzed's managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator) ### References - [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6) - [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet - [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux - [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue ### Credit We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1592.002 Software Reconnaissance
Adversaries may gather information about the victim's host software that can be used during targeting.
T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1592 Gather Victim Host Information Reconnaissance
Adversaries may gather information about the victim's hosts that can be used during targeting.
T1595 Active Scanning Reconnaissance
Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-64529Same product: Authzed Spicedb
CVE-2023-46255Same product: Authzed Spicedb
CVE-2025-65111Same product: Authzed Spicedb
CVE-2024-27101Same product: Authzed Spicedb
CVE-2024-46989Same product: Authzed Spicedb
CVE-2024-38361Same product: Authzed Spicedb
CVE-2024-32001Same product: Authzed Spicedb
CVE-2023-35930Same product: Authzed Spicedb
CVE-2026-40091Same product: Authzed Spicedb
CVE-2025-49011Same product: Authzed Spicedb

Affected Assets

authzed
spicedb
≤ 1.19.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V16.5.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-209

Detects error messages that leak sensitive information as evidence of disclosure.

addresses: CWE-209

The control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses.

addresses: CWE-209

Misdirection allows generation of misleading error messages that withhold or falsify sensitive details.

addresses: CWE-209

Explicitly requires error messages to avoid including sensitive or exploitable details while still supporting corrective action.

addresses: CWE-209

Validation ensures error messages contain only expected, non-sensitive content and blocks leakage via verbose errors.

addresses: CWE-209

Fail-safe procedures can be defined to suppress or sanitize error output, reducing generation of messages that contain sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards explicitly forbid exposing sensitive data in errors.

finds

Security testing can detect error messages that leak sensitive information.

A.8.15 Logging partial match
degrades

Logging policy can require suppression of sensitive data in error messages.

prevents

Secure SDLC mandates error-handling rules that avoid leaking sensitive information.

prevents

Application security requirements can specify safe error messaging.

prevents

Secure architecture principles include proper exception handling.

References