Advisories · Technology
openobserve.
Every CVE that names openobserve among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
- openobserve
- Information disclosure
- CVSS 7.7 High
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
- openobserve
- Server-side request forgery (SSRF)
- CVSS 8.4 High
OpenObserve's Invite Token Lifecycle Misconfiguration
- openobserve
- Broken access control
- Authentication bypass
- CVSS 3.5 Low
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
- openobserve
- Cross-site scripting (XSS)
- CVSS 8.7 High
OpenObserve Improper Authorization Allows Admin User to Remove Root User
- openobserve
- Privilege escalation
- Broken access control
- CVSS 7.2 High
OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`
- openobserve
- Cross-site scripting (XSS)
- CVSS 8.8 High
OpenObserve stored XSS vulnerability may lead to complete account takeover
- openobserve
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
OpenObserve Privilege Escalation Vulnerability in Users API
- openobserve
- Privilege escalation
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
OpenObserve Unauthorized Access Vulnerability in Users API
- openobserve
- Privilege escalation
- Broken access control