OpenObserve: Authentication bypass via empty password for accounts without password_ext
Summary
OpenObserve versions before 1.1.0 accept an empty or whitespace-only HTTP Basic password for accounts whose password_ext value is missing or empty. This state can occur for SSO-provisioned and migration-created users. An unauthenticated attacker who knows a victim's email address and organization can access protected non-ingestion API routes with the victim's role and permissions. If the victim has search permission, a DataFusion COPY statement may allow file writes that lead to remote code execution under certain conditions.
Affected
- OpenObserve versions before 1.1.0
- Accounts with a missing or empty password_ext value, e.g. SSO-provisioned or migrated users
Fixed in
- Fixed in version 1.1.0 (PR #15054)
Workaround
- Unknown. No vendor workaround documented; upgrading to 1.1.0 or later is the remedy.
- Restrict network access to the OpenObserve API and UI (VPN or reverse proxy with allow-listing) until the upgrade is done.
Exploitation
- No evidence of exploitation in the wild found at time of writing.
- No public proof-of-concept found; the CVE was published on 10 Nov 2026, so the absence of reports is not strong evidence yet.
Our recommendation
- Confirm the running version and upgrade to 1.1.0 or later.
- Until the upgrade, restrict access to the OpenObserve API and UI, especially if internet-exposed.
- Identify accounts with a missing or empty password_ext, particularly SSO-provisioned and migrated users, and review their roles.
- Review accounts with search permission.
- Review logs for Basic-auth logins to protected API routes.
- Verify the GHSA advisory and NVD entry for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7w4v-2c9r-q94v github.com
- Fix commit 46678ea (PR #15054) github.com
- Fix commit dc5c657 (validator.rs) github.com
- Pull request #15054 github.com
- OpenObserve v1.1.0 release github.com
- CVE record CVE-2026-126065 www.cve.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:21.
Original description (NVD)
OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.
NVD references (6)
- https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea
- https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a
- https://github.com/openobserve/openobserve/pull/15054
- https://github.com/openobserve/openobserve/releases/tag/v1.1.0
- https://github.com/openobserve/openobserve/security/advisories/GHSA-7w4v-2c9r-q94v
- https://github.com/openobserve/openobserve/security/advisories/GHSA-7w4v-2c9r-q94v
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.