CVE-2026-63199
HighCVSS 8.3Summary
Perses versions 0.43.0 through 0.54.0-rc.0 authorize datasource creation and unsaved datasource proxy paths on a Datasource or GlobalDatasource scope without requiring read permission for the separately grantable associated project or global Secret. A low-privilege user can attach a Secret they cannot read, point the datasource at a user-controlled service, and cause Perses to send the decrypted secret in plaintext, bypassing scope separation.
Risk Assessment
Bypassing project and global scope separation can lead to leakage of sensitive credentials, such as passwords or API keys, to an attacker.
Recommendation
Upgrade Perses to version 0.54.0-rc.0 or later, which fixes this issue.
Other vulnerabilities in Perses
See all- CVE-2026-63458High
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project.
- CVE-2026-63445High
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation.
Original NVD description (English source)
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0.