CVE-2026-63645

HIGH 7.5

OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.

CWE	CWE-200
Vendor	openobserve
Product	openobserve
Published	Sep 24, 2026

Stay Ahead of the Next One

Get instant alerts for openobserve openobserve

Be the first to know when new high vulnerabilities affecting openobserve openobserve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

openobserve / openobserve

< 0.90.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw github.com: https://github.com/openobserve/openobserve/pull/12220 github.com: https://github.com/openobserve/openobserve/commit/4f3db1cf790ffe8ea065d98f87344e839ec6e477 github.com: https://github.com/openobserve/openobserve/releases/tag/v0.90.3