CVE-2025-64744
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
OpenObserve versions up to and including 0.16.1 render HTML markup in organization names inside the invitation email template, indicating user-controlled input is inserted without proper HTML escaping. As of publication, no patched versions are available.
Risk Assessment
HTML injection into invitation emails sent to invited users may be exploited for phishing or other social engineering attacks.
Recommendation
Restrict the ability to create or rename organizations with HTML content and monitor for available OpenObserve updates, as no patched version currently exists.
Other vulnerabilities in OpenObserve
See all- CVE-2026-63645High
OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.
- CVE-2026-39361High
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
- CVE-2025-66223High
OpenObserve prior to version 0.16.0 does not expire organization invitation tokens, which remain valid even after the invited user is removed and allow multiple invitations to the same email with different roles. This results in broken access control where a removed or demoted user can regain access or escalate privileges. The issue is patched in version 0.16.0.
Original NVD description (English source)
OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS