Oopenobserve

Products

Exploited and recent CVEs

• CVE-2026-63645 High 7.5 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials 0.3%
• CVE-2026-39361 High 7.7 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url 0.3%
• CVE-2025-66223 High 8.4 OpenObserve's Invite Token Lifecycle Misconfiguration 0.3%
• CVE-2025-64744 Low 3.5 OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails 0.2%
• CVE-2024-55954 High 8.7 OpenObserve Improper Authorization Allows Admin User to Remove Root User 0.5%
• CVE-2024-41809 High 7.2 OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue` 0.4%
• CVE-2024-41808 High 8.8 OpenObserve stored XSS vulnerability may lead to complete account takeover 0.5%
• CVE-2024-24830 Critical 10.0 OpenObserve Privilege Escalation Vulnerability in Users API 0.7%
• CVE-2024-25106 Critical 9.1 OpenObserve Unauthorized Access Vulnerability in Users API 0.5%