CVE-2026-126065

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose passwordext value is missing or empty. SSO-provisioned and migration-creat...

CVE-2026-126065

The cloud-native observability platform OpenObserve is vulnerable to an authentication bypass in versions prior to 1.1.0 . The root cause is located in the shared authentication validator at src/api/common/src/auth/validator.rs, which incorrectly accepts empty or whitespace-only HTTP Basic passwo...

CVE-2026-126065 OpenObserve: Empty external password allows authentication bypass

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose passwordext value is missing or empty. SSO-provisioned and migration-creat...

PT-2026-144664

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 1.1.0 Description A flaw in the shared authentication validator located in src/api/common/src/auth/validator.rs allows an unauthenticated attacker to bypass authentication for accounts where the password ext value...