Is CVE-2026-63199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63199 being exploited in the wild.

How severe is CVE-2026-63199?

High severity, with a CVSS score of 4, published 18 September 2026.

Which products and versions are affected?

github.com/perses/perses (Go) >= 0.43.0, = 0.43.0, < 0.54.0-rc.0.

Is there a fix for CVE-2026-63199?

Yes. github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63199 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63199?

Check whether you run github.com/perses/perses (Go) or Perses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63199: Perses missing authorization in datasource proxy

Q: Is there a fix for CVE-2026-63199?

Yes. github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63199 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-63199?

Check whether you run github.com/perses/perses (Go) or Perses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63199 · Severity: high · CVSS 4 · Published 2026-09-18

Perses is an observability platform that manages data sources and secrets. A missing authorization check allows users with limited datasource creation permissions to attach and decrypt secrets they should not have access to, exposing sensitive credentials in plain text. An attacker can create a datasource, attach a secret they don't have permission to view, and then retrieve the unencrypted secret through the datasource proxy.

Technologies: github.com/perses/perses (Go), Perses. Vendors: Go, Perses.

Quick answers

Is CVE-2026-63199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63199 being exploited in the wild.
How severe is CVE-2026-63199?: High severity, with a CVSS score of 4, published 18 September 2026.
Which products and versions are affected?: github.com/perses/perses (Go) >= 0.43.0, < 0.54.0-rc.0, SEMVER:introduced=0.43.0,fixed=0.54.0-rc.0; Perses >= 0.43.0, < 0.54.0-rc.0.
Is there a fix for CVE-2026-63199?: Yes. github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63199 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63199?: Check whether you run github.com/perses/perses (Go) or Perses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/perses/perses (Go): upgrade to 0.54.0-rc.0 or later
```
go get github.com/perses/perses@v0.54.0-rc.0
```

Technical details

This is a missing authorization vulnerability (CWE-862) in Perses's datasource proxy and creation service. The proxy authorizes requests based on Datasource scope but fails to verify that the caller has Secret scope permissions before resolving and decrypting secrets referenced in the request body. Since Datasource and Secret are distinct role scopes, a user with only GlobalDatasource:create permission can exploit this by creating a datasource or using the "unsaved datasource" connectivity verification feature to attach a GlobalSecret, then retrieve the decrypted secret value. Attack vector is network-based and requires low privileges (a user account). The fix, released in v0.54.0-rc.0, adds authorization checks to verify the caller can read any secret before allowing it to be attached to a datasource.

Affected products

Perses Perses >= 0.43.0, < 0.54.0-rc.0

Identifiers

CVE-2026-63199
GHSA-4227-9989-jrhx
GO-2026-6514

Timeline

2026-07-16: disclosed
2026-09-18: patched: v0.54.0-rc.0 released

References

https://api.github.com/users/ImDuong

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.