CVE-2026-63645
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.
Risk Assessment
The organization is at risk of sensitive data leakage, such as database credentials and infrastructure details, which could enable further attacks. Unauthenticated access to configuration may lead to confidentiality and integrity breaches.
Recommendation
Immediately upgrade OpenObserve to version 0.90.3 or later. Additionally, restrict access to the /config/runtime endpoint via firewall rules or authentication.
Other vulnerabilities in OpenObserve
See all- CVE-2026-39361High
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
- CVE-2025-66223High
OpenObserve prior to version 0.16.0 does not expire organization invitation tokens, which remain valid even after the invited user is removed and allow multiple invitations to the same email with different roles. This results in broken access control where a removed or demoted user can regain access or escalate privileges. The issue is patched in version 0.16.0.
Original NVD description (English source)
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS