CVE-2026-63645: OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field names, so metapostgresdsn, metapostgresrodsn, metaddldsn, and usagereportingcreds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenObserveto a version that resolves this vulnerability.Fixed in 0.90.3
Event History
Frequently Asked Questions
Which deployments are most likely to expose credentials?
OpenObserve deployments using PostgreSQL may expose the plaintext values of meta_postgres_dsn, meta_postgres_ro_dsn, and meta_ddl_dsn through the unauthenticated endpoint. The response may also disclose usage_reporting_creds and other operational details.
What does an attacker need to exploit this issue?
An attacker only needs network access to the OpenObserve /config/runtime endpoint. No authentication, privileges, or user interaction are required.
How can I determine whether an instance is affected?
Instances running a version prior to 0.90.3 are affected. Affected instances register /config/runtime without authentication, and its response can include configuration fields whose names contain dsn or creds in plaintext.
What should be done after upgrading?
Upgrade to OpenObserve 0.90.3. For PostgreSQL-backed deployments, treat exposed DSNs and credentials as potentially compromised and rotate the associated database credentials; review other values returned by the endpoint, such as usage-reporting credentials.