CVE-2026-39361: OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validateenrichmenturl function in src/handler/http/request/enrichmenttable/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39361?
CVE-2026-39361 is considered a medium severity vulnerability due to the potential for unauthorized access through SSRF protection bypass.
How do I fix CVE-2026-39361?
To fix CVE-2026-39361, you should upgrade OpenObserve to version 0.70.4 or later, where the SSRF protection bypass is addressed.
Can CVE-2026-39361 be exploited remotely?
Yes, CVE-2026-39361 can be exploited remotely, allowing attackers to bypass SSRF protections by using IPv6 bracket notation.
Which versions of OpenObserve are affected by CVE-2026-39361?
CVE-2026-39361 affects OpenObserve versions 0.70.3 and earlier.
What is the impact of CVE-2026-39361 on OpenObserve?
The impact of CVE-2026-39361 includes the potential for attackers to access internal services or manipulate requests due to the SSRF protection flaw.