CVE-2026-63645: OpenObserve Information Disclosure Flaw

CVE-2026-63645 Overview

CVE-2026-63645 is an information disclosure vulnerability in OpenObserve, a cloud-native observability platform. Versions prior to 0.90.3 register the /config/runtime endpoint without authentication. The handler serializes the complete server configuration after applying the hide_sensitive_fields keyword filter, but the filter does not recognize dsn or creds field names. Unauthenticated network clients can retrieve meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds in plaintext. The response also discloses the root administrator email, internal NATS address, filesystem layout, and other deployment details. The issue is tracked under [CWE-200] and is fixed in version 0.90.3.

Critical Impact

Unauthenticated remote attackers can retrieve PostgreSQL connection strings and administrator contact information from an exposed OpenObserve instance.

Affected Products

• OpenObserve versions prior to 0.90.3
• OpenObserve open-source edition (config_routes without the enterprise feature)
• OpenObserve enterprise edition (config_routes with the enterprise feature)

Discovery Timeline

• 2026-09-24 - CVE-2026-63645 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-63645

Vulnerability Analysis

The vulnerability resides in the HTTP router module src/handler/http/router/mod.rs. Both the open-source and enterprise config_routes() functions register /runtime and /reload routes without authentication middleware. The /runtime handler, status::config_runtime, serializes the entire runtime configuration and applies a filter named hide_sensitive_fields before returning the response.

The filter matches on specific keyword patterns intended to redact secrets. It does not include dsn or creds in its match set. As a result, configuration fields such as meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds pass through the filter unredacted. Each of these fields typically contains a full database connection string with username, password, host, and database name.

Root Cause

Two defects combine to produce the disclosure. First, a missing authentication constraint on the /config/runtime route allows anonymous access. Second, an incomplete deny-list in hide_sensitive_fields fails to recognize DSN-style and credentials-style identifiers. The classification maps to Exposure of Sensitive Information to an Unauthorized Actor [CWE-200].

Attack Vector

An attacker sends an unauthenticated HTTP GET request to the /config/runtime endpoint on an exposed OpenObserve instance. The server returns a serialized configuration document containing PostgreSQL connection strings, the root administrator email, the internal NATS address, and filesystem layout details. The attacker can then use the recovered PostgreSQL credentials to connect directly to the metadata database if network reachability exists.

     Router::new()
         .route("/", get(status::zo_config))
         .route("/logout", get(status::logout))
-        .route("/runtime", get(status::config_runtime))
-        .route("/reload", get(status::config_reload))
 }
 
 #[cfg(feature = "enterprise")]
 pub fn config_routes() -> Router {
     Router::new()
         .route("/", get(status::zo_config))
         .route("/logout", get(status::logout))
-        .route("/runtime", get(status::config_runtime))
-        .route("/reload", get(status::config_reload))
         .route("/redirect", get(status::redirect))
         .route("/dex_login", get(status::dex_login))
         .route("/dex_refresh", get(status::refresh_token_with_dex))

Source: GitHub Commit 4f3db1c. The patch removes the /runtime and /reload routes from both route groups, eliminating the exposed handlers.

Detection Methods for CVE-2026-63645

Indicators of Compromise

• HTTP GET requests to /config/runtime from external or non-administrative source addresses.
• Access log entries for /config/runtime or /config/reload without a corresponding authenticated session.
• Outbound connections to the PostgreSQL metadata database originating from unexpected IP addresses after suspected access.

Detection Strategies

• Inspect reverse proxy, load balancer, or ingress logs for anonymous requests to the /config/ path tree.
• Correlate requests to /config/runtime with subsequent authentication attempts against PostgreSQL instances holding OpenObserve metadata.
• Alert on OpenObserve versions earlier than 0.90.3 identified through vulnerability scans or software inventory data.

Monitoring Recommendations

• Forward OpenObserve HTTP access logs to a centralized log platform and build a rule for /config/runtime requests.
• Monitor PostgreSQL pg_stat_activity for logins using the OpenObserve metadata account from unexpected hosts.
• Track egress traffic from OpenObserve pods or hosts to detect reconnaissance that follows configuration disclosure.

How to Mitigate CVE-2026-63645

Immediate Actions Required

• Upgrade all OpenObserve deployments to version 0.90.3 or later.
• Rotate PostgreSQL credentials referenced by meta_postgres_dsn, meta_postgres_ro_dsn, and meta_ddl_dsn.
• Rotate the credentials configured in usage_reporting_creds.
• Review access logs for prior requests to /config/runtime and treat matching source addresses as suspect.

Patch Information

The fix is available in OpenObserve v0.90.3. The patch is tracked in Pull Request #12220 and commit 4f3db1c. Full details are documented in GitHub Security Advisory GHSA-v496-g5c9-vqxw.

Workarounds

• Block external access to the /config/runtime and /config/reload paths at a reverse proxy or web application firewall.
• Restrict OpenObserve HTTP exposure to trusted management networks until the upgrade is applied.
• Place the PostgreSQL metadata database on a network segment unreachable from the OpenObserve HTTP interface.

# NGINX reverse proxy snippet to block the vulnerable endpoints
location ~ ^/config/(runtime|reload)$ {
    return 403;
}