All CVEs — page 12 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
OpenObserve prior to v1.1.0 allows authentication bypass via empty or whitespace-only HTTP Basic passwords for users with missing password_ext values, enabling attackers who know a victim's email and organization to impersonate them on non-ingestion API routes. This grants full access to telemetry, alerts, streams, users, and security configurations, and can be escalated to remote code execution via the DataFusion COPY ... TO statement.