CVE-2026-126065— OpenObserve: Empty external password allows authentication bypass

Quick assessment

Affected

openobserve openobserve

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenObserve 是一个云原生的可观测性平台。在 1.1.0 版本之前，位于中的共享身份验证验证器会接受空密码或仅包含空白字符的 HTTP Basic 密码，前提是目标账户的字段缺失或为空。通过单点登录（SSO）配置或迁移创建的账户可能处于此状态，这使得未认证的攻击者只要知道受影响用户的电子邮件地址及其所属组织，即可使用该受害者的角色和权限，通过受保护的非数据摄入（non-ingestion）API 路由进行身份验证。若特权账户被攻破，攻击者可暴露或修改遥测数据、告警、数据流、用户信息以及安全配置。此外

CVSS 9.8 · Critical Updated Nov 11, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenObserve: Empty external password allows authentication bypass

Source: CVE Program / CVE List V5

Vulnerability Description

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
openobserve	openobserve	< 1.1.0	-

II. Public POCs for CVE-2026-126065

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126065

请登录查看更多情报信息。

Other References for CVE-2026-126065 (5)

https://github.com/openobserve/openobserve/pull/15054 x_refsource_MISC
https://github.com/openobserve/openobserve/releases/tag/v1.1.0 x_refsource_MISC
https://github.com/openobserve/openobserve/security/advisories/GHSA-7w4v-2c9r-q94v x_refsource_CONFIRM
https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a x_refsource_MISC
https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-126065

IV. Related Vulnerabilities

Same product: openobserve

Same vendor: openobserve

Same weakness: CWE-287