OpenObserve vulnerabilities

OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.

OpenObserve prior to version 0.16.0 does not expire organization invitation tokens, which remain valid even after the invited user is removed and allow multiple invitations to the same email with different roles. This results in broken access control where a removed or demoted user can regain access or escalate privileges. The issue is patched in version 0.16.0.