SpiceDB versions 1.49.0 through 1.51.0 record the full datastore connection string—including the plaintext password—in info‑level logs during startup. The configuration log is exposed to anyone who can read log output, providing unauthenticated access to credentials that could be used to connect to the underlying database or compromise other services that rely on that connection. This disclosure can lead to data leakage or unauthorized data manipulation, representing a moderate‑severity confidentiality compromise. The weakness is classified as improper output of sensitive information, CWE‑532.

The vulnerability affects the Authzed SpiceDB product from versions 1.49.0 to 1.51.0. Users running any of those releases are impacted until they upgrade to 1.51.1 or later.

The CVSS score is 6.0, indicating moderate severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation yet still presenting a tangible risk. Attackers could exploit the leak if they can view application logs, which may be the case in cloud environments with shared logging or if logs are forwarded to central log management systems without proper access controls. The defect is generally exploitable by anyone with log access and is limited to information disclosure; additional privileges would be required for further damage.