openobserve vulnerabilities
10 published CVEs name openobserve among the affected products.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 3Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126065
OpenObserve: Empty external password allows authentication bypass
openobserve · openobserve
Critical9.8 - CVE-2026-63645
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
openobserve · openobserve
High7.5 - CVE-2026-39361
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
openobserve · openobserve
High7.7 - CVE-2025-66223
OpenObserve's Invite Token Lifecycle Misconfiguration
openobserve · openobserve
High8.4 - CVE-2025-64744
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
openobserve · openobserve
Low3.5 - CVE-2024-55954
OpenObserve Improper Authorization Allows Admin User to Remove Root User
openobserve · openobserve
High8.7 - CVE-2024-41809
OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`
openobserve · openobserve
High7.2 - CVE-2024-41808
OpenObserve stored XSS vulnerability may lead to complete account takeover
openobserve · openobserve
High8.8 - CVE-2024-24830
OpenObserve Privilege Escalation Vulnerability in Users API
openobserve · openobserve
Critical10.0 - CVE-2024-25106
OpenObserve Unauthorized Access Vulnerability in Users API
openobserve · openobserve
Critical9.1