{"cve":"CVE-2023-29193","nvd":{"published":"2023-04-14T20:15:09.670","modified":"2026-06-17T05:49:34.783","status":"Modified","description":"SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1.\n\n### Impact\n\nAll deployments abiding by the recommended best practices for production usage are **NOT affected**:\n- Authzed's SpiceDB Serverless\n- Authzed's SpiceDB Dedicated\n- SpiceDB Operator\n\nUsers configuring SpiceDB via environment variables are **NOT affected**.\n\nUsers **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag.\n\n### Patches\n\nTODO\n\n### Workarounds\n\nTo workaround this issue you can do one of the following:\n\n- Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`)\n- Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`)\n- Disable the metrics service via the flag (e.g. `--metrics-enabled=false`)\n- Adopt one of the recommended deployment models: [Authzed's managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator)\n\n### References\n\n- [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6)\n- [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet\n- [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux\n- [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue\n\n### Credit\n\nWe'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-209"],"references":["https://github.com/authzed/spicedb/commit/9bbd7d76b6eaba33fe0236014f9b175d21232999","https://github.com/authzed/spicedb/releases/tag/v1.19.1","https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6","https://github.com/authzed/spicedb/commit/9bbd7d76b6eaba33fe0236014f9b175d21232999","https://github.com/authzed/spicedb/releases/tag/v1.19.1"],"products":["authzed:spicedb"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2023-29193","score":0.00762,"percentile":0.5538,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cjr9-mr35-7xh6","url":"https://osv.dev/vulnerability/GHSA-cjr9-mr35-7xh6","summary":"SpiceDB binding metrics port to untrusted networks and can leak command-line flags","modified":"2026-09-10T03:49:53.763018133Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":["<1.19.1"],"fixed":["1.19.1"]}]},{"id":"GO-2023-1723","url":"https://osv.dev/vulnerability/GO-2023-1723","summary":"SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb","modified":"2026-02-04T02:45:12.743858Z","packages":[{"ecosystem":"Go","name":"github.com/authzed/spicedb","purl":"pkg:golang/github.com/authzed/spicedb","ranges":["<1.19.1"],"fixed":["1.19.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}