CVE-2026-28328

Summary

SolarWinds Observability Self-Hosted has a broken authorization schema allowing low-privileged users to access and modify data beyond their permissions due to insufficient access control enforcement.

Exploitability

Exploitation requires valid low-privileged credentials and knowledge of protected endpoints; no public exploit exists, but the vulnerability is straightforward for authenticated attackers.

Blast radius

An attacker could read sensitive data, alter configurations, or disrupt operations across the platform, potentially compromising confidentiality, integrity, and availability.

Detection

Monitor for anomalous API calls from low-privileged users to administrative endpoints (e.g., /api/v2/admin/*, /settings/*) with elevated privilege patterns in access logs; look for unexpected writes to sensitive configuration resources.

Prioritized remediation

Upgrade to SolarWinds Observability Self-Hosted version 2.590 or later, which includes the vendor's fix for this authorization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.