# CVE-2026-126065: OpenObserve authentication bypass with empty password

Source: https://junglewise.ai/threats/cve-2026-126065-openobserve-is-a-cloud-native-observability-platform-prior-to-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126065 · Severity: critical · CVSS 9.8 · Published 2026-11-10

OpenObserve is a cloud-native platform for monitoring and analyzing telemetry data from applications and infrastructure. An attacker who knows a user's email address can bypass authentication on API routes by submitting an empty password, impersonating that user with their full permissions. Attackers can then read or modify monitoring data, security settings, and user accounts, or execute arbitrary code by uploading files to the server.

Technologies: [Openobserve](https://junglewise.ai/threats/technologies/openobserve). Vendors: [Openobserve](https://junglewise.ai/threats/vendors/openobserve).

## Quick answers

**Is CVE-2026-126065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126065 being exploited in the wild.

**How severe is CVE-2026-126065?** Critical severity, with a CVSS score of 9.8, published 10 November 2026.

**Which products and versions are affected?** Openobserve before 1.1.0.

**Is there a fix for CVE-2026-126065?** Yes: fixed in 1.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126065 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126065?** Check whether you run Openobserve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.0

## Technical details

The authentication validator in validator.rs accepts empty or whitespace-only HTTP Basic passwords when a user's password_ext field is missing or empty, a state that can occur for SSO-provisioned or migration-created accounts. An unauthenticated attacker with knowledge of a target user's email and organization can authenticate to protected non-ingestion API routes with the victim's role and permissions. Escalation to remote code execution is possible via a DataFusion COPY statement in the search API from an account with search permissions.

## Affected products

- OpenObserve OpenObserve before 1.1.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea](https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea)
- [https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a](https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a)

## Related threats

- [OpenObserve unauthenticated config endpoint information disclosure](https://junglewise.ai/threats/cve-2026-63645-openobserve-is-a-cloud-native-observability-platform-prior-to-0)
- [OpenObserve SSRF bypass via IPv6 bracket notation in enrichment URLs](https://junglewise.ai/threats/cve-2026-39361-openobserve-ssrf-bypass-via-ipv6-bracket-notation-in-enrichment)