CVE-2026-126065

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.

• CWE-287

• https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea
• https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a
• https://github.com/openobserve/openobserve/pull/15054
• https://github.com/openobserve/openobserve/releases/tag/v1.1.0
• https://github.com/openobserve/openobserve/security/advisories/GHSA-7w4v-2c9r-q94v

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126051A deferred-callback use-after-destroy in Node.js TLS server …7.5
• CVE-2026-12606Eclipse Grizzly in versions before 5.0.2, cannot properly pa…5.3
• CVE-2026-126061Winter CMS is a content management system built on the Larav…4.3
• CVE-2026-126062Nokogiri is an open source XML and HTML library for the Ruby…3.7
• CVE-2026-126063Nokogiri is an open source XML and HTML library for the Ruby…2.3
• CVE-2026-126064Nokogiri is an open source XML and HTML library for the Ruby…2
• CVE-2026-126066fast-xml-parser allows users to process XML from JS object w…3.7
• CVE-2026-126067Action Pack is a framework for handling and responding to we…3.1
• CVE-2026-126068Action Mailbox routes incoming emails to controller-like mai…3.7
• CVE-2026-126069Action View is a framework for handling view template lookup…4.7
• CVE-2026-126070Action View is a framework for handling view template lookup…6.1
• CVE-2026-126071Active Storage makes it simple to upload and reference files…5.3