CVE-2026-39361
An authenticated attacker can reach internal services blocked from external access.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
- CVSS 3.1
- 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS
- 0.27% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- openobserve/openobserve
- Source
- security-advisories@github.com
References
- https://github.com/openobserve/openobserve/commit/d1a5d8f65b432e2e82f83231390dec7f107e8d75Patch
- https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79Exploit, Mitigation, Vendor Advisory
- https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79Exploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.