Is CVE-2026-63645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63645 being exploited in the wild.

How severe is CVE-2026-63645?

High severity, with a CVSS score of 7.5, published 24 September 2026.

Is there a fix for CVE-2026-63645?

A patch was published on 2026-05-25: Fix merged in version 0.90.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63645 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63645?

Check whether you run Openobserve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63645: OpenObserve unauthenticated config endpoint information disclosure

CVE-2026-63645 · Severity: high · CVSS 7.5 · Published 2026-09-24

OpenObserve is a cloud-native platform for monitoring and analyzing system performance. A flaw in versions before 0.90.3 exposes sensitive configuration data—including database credentials, administrator emails, and internal infrastructure details—through an unprotected endpoint accessible to anyone on the network. An attacker can use this exposed information to compromise databases, target administrators, or plan further attacks on the deployment.

Technologies: Openobserve. Vendors: Openobserve.

Quick answers

Is CVE-2026-63645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63645 being exploited in the wild.
How severe is CVE-2026-63645?: High severity, with a CVSS score of 7.5, published 24 September 2026.
Which products and versions are affected?: Openobserve before 0.90.3.
Is there a fix for CVE-2026-63645?: A patch was published on 2026-05-25: Fix merged in version 0.90.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63645 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63645?: Check whether you run Openobserve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /config/runtime endpoint lacks authentication and returns the full server configuration with an incomplete secret filter that fails to recognize credential field names like dsn, creds, meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds. An unauthenticated network attacker can directly access this endpoint to extract plaintext PostgreSQL credentials, administrator email, NATS service addresses, and filesystem paths without requiring any credentials or user interaction. The issue is fixed in version 0.90.3 by disabling the vulnerable endpoint.

Affected products

OpenObserve OpenObserve before 0.90.3

Timeline

2026-09-24: disclosed
2026-05-25: patched: Fix merged in version 0.90.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.