CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...

PT-2026-98199

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.90.3 Description The '/config/runtime' endpoint is registered without authentication. The system serializes the server configuration using a hide sensitive fields keyword filter that fails to recognize field nam...

CVE-2025-1709 CVE-2025-1709

Several credentials for the local PostgreSQL database are stored in plain text partially base64 encoded...

CVE-2025-1709 CVE-2025-1709

Several credentials for the local PostgreSQL database are stored in plain text partially base64 encoded...

CVE-2018-10286

The CVE-2018-10286 case involves Ericsson-LG iPECS NMS A.1Ac Web App. It discloses sensitive data (NMS admin credentials and PostgreSQL credentials) to logged-in users via HTTP POST responses. Affected component: web application; root cause: credentials exposed in responses to authenticated reque...

PT-2018-9802

Name of the Vulnerable Software and Affected Versions: Ericsson-LG iPECS NMS A.1Ac version affected versions not specified Description: The issue allows disclosure of sensitive information, including NMS admin credentials and PostgreSQL database credentials, to logged-in users through responses t...

CVE-2018-10286: Insufficiently Protected Credentials

The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credentials to logged-in users via the responses to certain HTTP POST requests. In order to be able to see the credentials in cleartext, an attacker needs ...