PT-2026-30984 · Unknown · Openobserve

Morimori-Dev · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39361

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.70.4

Description OpenObserve, a cloud-native observability platform, has an issue where the validate enrichment url function in src/handler/http/request/enrichment table/mod.rs does not properly block IPv6 addresses. The Rust url crate returns IPv6 addresses with surrounding brackets (e.g., '[::1]' instead of '::1'). This allows an authenticated attacker to access internal services that are blocked from external access. In cloud deployments, this can lead to the retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. In self-hosted deployments, it allows probing of internal network services.

Recommendations Update to version 0.70.4 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-39361

Affected Products

Openobserve

References · 4

• 🔥 https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79 · Exploit
• https://github.com/openobserve/openobserve/commit/d1a5d8f65b432e2e82f83231390dec7f107e8d75 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39361 · Security Note
• https://twitter.com/CVEnew/status/2041603149832524049 · Twitter Post