Executive brief
Perses is an observability platform that manages data sources and secrets. A missing authorization check allows users with limited datasource creation permissions to attach and decrypt secrets they should not have access to, exposing sensitive credentials in plain text. An attacker can create a datasource, attach a secret they don't have permission to view, and then retrieve the unencrypted secret through the datasource proxy.
Technical details
This is a missing authorization vulnerability (CWE-862) in Perses's datasource proxy and creation service. The proxy authorizes requests based on Datasource scope but fails to verify that the caller has Secret scope permissions before resolving and decrypting secrets referenced in the request body. Since Datasource and Secret are distinct role scopes, a user with only GlobalDatasource:create permission can exploit this by creating a datasource or using the "unsaved datasource" connectivity verification feature to attach a GlobalSecret, then retrieve the decrypted secret value. Attack vector is network-based and requires low privileges (a user account). The fix, released in v0.54.0-rc.0, adds authorization checks to verify the caller can read any secret before allowing it to be attached to a datasource.
Affected products
- Perses Perses >= 0.43.0, < 0.54.0-rc.0
Timeline
- 2026-07-16: disclosed
- 2026-09-18: patched: v0.54.0-rc.0 released