CVE-2026-28325 SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-28325

SolarWinds Observability Self-Hosted is impacted by an unauthenticated remote code execution vulnerability. This flaw originates from the deserialization of untrusted data when the application is configured to use a specific communication mode. The vulnerability allows for high impact on confiden...

EUVD-2026-84807

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

CVE-2026-28324 SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

CVE-2026-28324

The SolarWinds Observability Self-Hosted platform is vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is identified as insufficient integrity checks affecting installations configured in non-default and non-secure configurations . This vulnerability has a...

CVE-2026-28324 SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

EUVD-2026-84505

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-28325: Deserialization of Untrusted Data

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-28324: Insufficient Verification of Data Authenticity

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected...

PT-2026-96967

Name of the Vulnerable Software and Affected Versions SolarWinds Observability Self-Hosted affected versions not specified Description An unauthenticated remote code execution issue exists due to the deserialization of untrusted data. This occurs when the application is configured to use a specif...

PT-2026-96966

Name of the Vulnerable Software and Affected Versions SolarWinds Observability Self-Hosted versions prior to 2026.2.3 Description An unauthenticated remote code execution issue exists due to insufficient integrity checks. This affects installations configured in a non-default and non-secure...

CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685 Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685

A misconfiguration in the addon-framework library's cmdfactory.newcontrollercommandconfig exposes an unauthenticated debug endpoint on the multicluster-observability-addon component. After completing a basic encrypted connection, a remote attacker on an adjacent network can retrieve sensitive ope...

EUVD-2026-82981

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685 Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...