CVE-2025-66223
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
OpenObserve prior to version 0.16.0 does not expire organization invitation tokens, which remain valid even after the invited user is removed and allow multiple invitations to the same email with different roles. This results in broken access control where a removed or demoted user can regain access or escalate privileges. The issue is patched in version 0.16.0.
Risk Assessment
A removed or demoted user can regain access to the organization or escalate privileges, undermining access control and data security.
Recommendation
Update OpenObserve to version 0.16.0 or later and invalidate existing invitation tokens.
Other vulnerabilities in OpenObserve
See all- CVE-2026-63645High
OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.
- CVE-2026-39361High
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
Original NVD description (English source)
OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS