CVE-2026-63645

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.90.3

Description The '/config/runtime' endpoint is registered without authentication. The system serializes the server configuration using a hide sensitive fields keyword filter that fails to recognize field names containing dsn or creds. Consequently, an unauthenticated network client can obtain plaintext values for meta postgres dsn, meta postgres ro dsn, meta ddl dsn, and usage reporting creds. This may lead to the exposure of PostgreSQL database credentials, the root administrator email address, internal NATS address, filesystem layout, and other deployment details.

Recommendations Update to version 0.90.3. Restrict access to the '/config/runtime' endpoint to minimize the risk of exploitation.