CVE-2026-63645
Received Received - Intake

Information Disclosure in OpenObserve

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-63645
EUVD
EUVD-2026-86328

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openobserve openobserve 0.90.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenObserve is a cloud-native observability platform. A vulnerability in versions before 0.90.3 allows unauthenticated access to the /config/runtime endpoint. This endpoint exposes server configuration details after applying a filter that fails to hide sensitive fields like database credentials and connection strings.

Detection Guidance

Check if OpenObserve version is below 0.90.3 by inspecting the running instance or logs. Use curl to query the /config/runtime endpoint: curl http://<target>:<port>/config/runtime. If the response includes sensitive fields like meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, or usage_reporting_creds, the system is vulnerable.

Impact Analysis

An attacker could retrieve plaintext database credentials, root administrator email, internal NATS address, and filesystem details. This could lead to unauthorized database access, data breaches, or further network compromise.

Compliance Impact

This vulnerability could result in unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may lead to legal penalties and reputational damage.

Mitigation Strategies

Upgrade OpenObserve to version 0.90.3 or later immediately. If upgrading is not possible, restrict access to the /config/runtime endpoint via network policies or firewall rules until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart