openobserve vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20253
3. 20262

Newest CVEs

• CVE-2026-63645

  OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

  openobserve · openobserve

  High7.5
• CVE-2026-39361

  OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url

  openobserve · openobserve

  High7.7
• CVE-2025-66223

  OpenObserve's Invite Token Lifecycle Misconfiguration

  openobserve · openobserve

  High8.4
• CVE-2025-64744

  OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails

  openobserve · openobserve

  Low3.5
• CVE-2024-55954

  OpenObserve Improper Authorization Allows Admin User to Remove Root User

  openobserve · openobserve

  High8.7
• CVE-2024-41809

  OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`

  openobserve · openobserve

  High7.2
• CVE-2024-41808

  OpenObserve stored XSS vulnerability may lead to complete account takeover

  openobserve · openobserve

  High8.8
• CVE-2024-24830

  OpenObserve Privilege Escalation Vulnerability in Users API

  openobserve · openobserve

  Critical10.0
• CVE-2024-25106

  OpenObserve Unauthorized Access Vulnerability in Users API

  openobserve · openobserve

  Critical9.1