CVE-2026-63645

Versions of OpenObserve prior to 0.90.3 are vulnerable to an information disclosure flaw where the /config/runtime endpoint is accessible without authentication. The application fails to properly filter sensitive fields, such as meta_postgres_dsn , meta_postgres_ro_dsn , meta_ddl_dsn , and usage_...

CVE-2026-63645 OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...