Read the docs
TI-2026-45286 Aliases CVE-2026-63645

OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

Priority LOW 39CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed openobserve (openobserve): 0.90.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openobserveopenobservebefore 0.90.30.90.3Patch availableCNA
  • openobserve Vendoropenobserve Affected before 0.90.3 Fixed in 0.90.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*——openobserve
  • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:* Versions — — ·openobserve

Remediation

  • Fix · CNA openobserve (openobserve) Fixed in 0.90.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63645
  2. 2026-10-05 CISA SSVC decision points changed

References

Other 4

  • TI-2024-16347 OpenObserve Privilege Escalation Vulnerability in Users API CVSS 3.1CRITICAL 10.0
  • TI-2024-36995 OpenObserve Improper Authorization Allows Admin User to Remove Root User CVSS 3.1HIGH 8.7
  • TI-2024-27852 OpenObserve stored XSS vulnerability may lead to complete account takeover CVSS 3.1HIGH 8.8
  • TI-2025-40725 OpenObserve's Invite Token Lifecycle Misconfiguration CVSS 4.0HIGH 8.4
  • TI-2026-28348 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url CVSS 3.1HIGH 7.7
  • TI-2025-40082 OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails CVSS 3.1LOW 3.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences