Read the docs
TI-2025-40082 Aliases CVE-2025-64744

OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails

Priority MEDIUM 50CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00192 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openobserveopenobserveup to 0.16.1—No fix listedCNA
  • openobserve Vendoropenobserve Affected up to 0.16.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*——openobserve
  • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:* Versions — — ·openobserve

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64744

References

Other 1

  • TI-2024-16347 OpenObserve Privilege Escalation Vulnerability in Users API CVSS 3.1CRITICAL 10.0
  • TI-2024-36995 OpenObserve Improper Authorization Allows Admin User to Remove Root User CVSS 3.1HIGH 8.7
  • TI-2024-27852 OpenObserve stored XSS vulnerability may lead to complete account takeover CVSS 3.1HIGH 8.8
  • TI-2025-40725 OpenObserve's Invite Token Lifecycle Misconfiguration CVSS 4.0HIGH 8.4
  • TI-2026-28348 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url CVSS 3.1HIGH 7.7
  • TI-2024-16561 OpenObserve Unauthorized Access Vulnerability in Users API CVSS 3.1CRITICAL 9.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences