High severity · published Apr 7, 2026
CVE-2026-39361
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openobserve · openobserve
<= 0.70.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39361
Patch
https://github.com/openobserve/openobserve/commit/d1a5d8f65b432e2e82f83231390dec7f107e8d75
Exploit
https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79
More from openobserve
8.8
CVE-2024-24830
OpenObserve Privilege Escalation Vulnerability in Users API
8.7
CVE-2024-55954
OpenObserve Improper Authorization Allows Admin User to Remove Root User
8.4
CVE-2025-66223
OpenObserve's Invite Token Lifecycle Misconfiguration
7.5
CVE-2026-63645
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials
6.5
CVE-2024-25106
OpenObserve Unauthorized Access Vulnerability in Users API