CVE-2026-126065 OpenObserve: Empty external password allows authentication bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-126065?
CVE-2026-126065 is a critical vulnerability in openobserve, published on 10 Nov 2026.
Official description
OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-126065?
How do I fix CVE-2026-126065?
No fix has been published for CVE-2026-126065 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-126065 being exploited?
There is no known exploitation of CVE-2026-126065 in the wild and no public exploit code.
Sources
Also known as GHSA-7w4v-2c9r-q94v.