SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data.

The /debug/pprof/cmdline endpoint served by the metrics service (defaulting running on port 9090) reveals the command-line flags provided for debugging purposes. If a password is set via the --grpc-preshared-key then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1. ### Impact All deployments abiding by the recommended best practices for production usage are NOT affected: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator Users configuring SpiceDB via environment variables are NOT affected.

Users MAY be affected if they expose their metrics port to an untrusted network and are configuring --grpc-preshared-key via command-line flag. ### Patches TODO ### Workarounds To workaround this issue you can do one of the following: - Configure the preshared key via an environment variable (e.g. SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve) - Reconfigure the --metrics-addr flag to bind to a trusted network (e.g. --metrics-addr=localhost:9090) - Disable the metrics service via the flag (e.g. --metrics-enabled=false) - Adopt one of the recommended deployment models: Authzed's managed services or the SpiceDB Operator ### References - GitHub Security Advisory issued for SpiceDB - Go issue #22085 for documenting the risks of exposing pprof to the internet - Go issue #42834 discusses preventing pprof registration to the default serve mux - semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure checks for a variation of this issue ### Credit We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.