Quick answers
- Is CVE-2026-39361 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39361 being exploited in the wild.
- How severe is CVE-2026-39361?
- High severity, with a CVSS score of 7.7, published 7 April 2026.
- Which products and versions are affected?
- Openobserve <= 0.70.3.
- Is there a fix for CVE-2026-39361?
- A patch was published on 2026-04-07: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-39361 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-39361?
- Check whether you run Openobserve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `validate_enrichment_url` function within `src/handler/http/request/enrichment_table/mod.rs`. The root cause is a failure to account for the bracket notation used for IPv6 addresses in Rust's `url` crate (e.g., "[::1]" instead of "::1"). Because the validation logic compares the host string directly and attempts to parse it as an IP address without stripping brackets, it fails to identify loopback, private, or link-local addresses. An authenticated attacker can use payloads like `http://[::ffff:169.254.169.254]/` to bypass blocklists and reach internal network services or cloud metadata services (IMDS). A patch has been committed to enhance URL validation by stripping brackets before performing IP checks.
Affected products
- OpenObserve OpenObserve <= 0.70.3
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed
- 2026-04-07: patched: Fix committed to repository