CVE-2026-126065

Summary

OpenObserve prior to v1.1.0 allows authentication bypass via empty or whitespace-only HTTP Basic passwords for users with missing password_ext values, enabling attackers who know a victim's email and organization to impersonate them on non-ingestion API routes. This grants full access to telemetry, alerts, streams, users, and security configurations, and can be escalated to remote code execution via the DataFusion COPY ... TO statement.

Exploitability

Exploitation requires knowledge of a valid user's email address and organization, and is straightforward for unauthenticated attackers targeting SSO-provisioned or migration-created accounts with empty password_ext fields.

Blast radius

Successful exploitation grants full administrative control over the observability platform, including data exfiltration, configuration tampering, and potential pre-authentication RCE via file creation overwrites.

Detection

Defenders should monitor for non-ingestion API requests (e.g., /api/*/users, /api/*/alerts, /api/*/streams) authenticated with HTTP Basic credentials where the password field is empty or whitespace-only and the user has a missing or empty password_ext value in the backend; such requests are anomalous and indicate likely exploitation.

Prioritized remediation

Upgrade to OpenObserve version 1.1.0 or later to patch the authentication validator flaw in src/api/common/src/auth/validator.rs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.