Read the docs
TI-2024-27852 Aliases CVE-2024-41808

OpenObserve stored XSS vulnerability may lead to complete account takeover

Priority HIGH 73CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openobserveopenobserveup to 0.9.1—No fix listedCNA
  • openobserve Vendoropenobserve Affected up to 0.9.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*up to 0.9.1Vulnerableopenobserve
  • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:* Versions up to 0.9.1 Vulnerable ·openobserve

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41808

References

Exploit 1

  • TI-2024-16347 OpenObserve Privilege Escalation Vulnerability in Users API CVSS 3.1CRITICAL 10.0
  • TI-2026-28348 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url CVSS 3.1HIGH 7.7
  • TI-2024-16561 OpenObserve Unauthorized Access Vulnerability in Users API CVSS 3.1CRITICAL 9.1
  • TI-2024-27853 OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue` CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences