CVE-2026-126065

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 1.1.0

Description A flaw in the shared authentication validator located in src/api/common/src/auth/validator.rs allows an unauthenticated attacker to bypass authentication for accounts where the password ext value is missing or empty, such as users created via migration or SSO provisioning. By providing an empty or whitespace-only HTTP Basic password along with the victim's email address and organization, an attacker can gain access to protected non-ingestion API routes with the victim's permissions. If a privileged account is compromised, the attacker can modify or expose telemetry, alerts, streams, users, and security configurations. Furthermore, an account with search permissions can use the search API to execute a DataFusion COPY ... TO statement, enabling the creation or overwriting of files in locations writable by the service process, which can lead to remote code execution.

Recommendations Update to version 1.1.0.