VYPR
← All advisories
High severity7.7NVD Advisory· Published Apr 7, 2026· Updated Apr 14, 2026

CVE-2026-39361

CVE-2026-39361

Description

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Openobserve/Openobserve2 versions
    cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*range: <=0.70.3
    • (no CPE)range: <=0.70.3

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.