CVE-2026-39361
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
Risk Assessment
An attacker can access sensitive internal services, including cloud metadata, which can lead to credential theft and further infrastructure compromise.
Recommendation
Update OpenObserve to version 0.70.4 or later. In the meantime, restrict API access for authenticated users.
Other vulnerabilities in OpenObserve
See all- CVE-2026-63645High
OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.
- CVE-2025-66223High
OpenObserve prior to version 0.16.0 does not expire organization invitation tokens, which remain valid even after the invited user is removed and allow multiple invitations to the same email with different roles. This results in broken access control where a removed or demoted user can regain access or escalate privileges. The issue is patched in version 0.16.0.
- CVE-2025-64744Low
OpenObserve versions up to and including 0.16.1 render HTML markup in organization names inside the invitation email template, indicating user-controlled input is inserted without proper HTML escaping. As of publication, no patched versions are available.
Original NVD description (English source)
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS