Executive brief
OpenObserve is a cloud-native observability platform used for log and metric analysis. A security flaw allows logged-in users to bypass network restrictions and force the server to make requests to internal systems. This could allow an attacker to steal sensitive cloud credentials (like AWS IAM roles) or probe private internal network services that are not supposed to be accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `validate_enrichment_url` function within `src/handler/http/request/enrichment_table/mod.rs`. The root cause is a failure to account for the bracket notation used for IPv6 addresses in Rust's `url` crate (e.g., "[::1]" instead of "::1"). Because the validation logic compares the host string directly and attempts to parse it as an IP address without stripping brackets, it fails to identify loopback, private, or link-local addresses. An authenticated attacker can use payloads like `http://[::ffff:169.254.169.254]/` to bypass blocklists and reach internal network services or cloud metadata services (IMDS). A patch has been committed to enhance URL validation by stripping brackets before performing IP checks.
Affected products
- OpenObserve OpenObserve <= 0.70.3
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed
- 2026-04-07: patched: Fix committed to repository