CyberRota Analysis
AI-GeneratedOpenObserve versions prior to 0.90.3 are vulnerable due to an unauthenticated endpoint that exposes sensitive server configuration details, including PostgreSQL database credentials and other critical deployment information. This vulnerability can lead to unauthorized access and potential exploitation of the database and infrastructure. Organizations using affected versions should prioritize upgrading to 0.90.3 to mitigate the risk of credential exposure and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.