---
id: "CVE-2026-126065"
page: "https://infrastack.ai/live/CVE-2026-126065"
kind: "vulnerability"
aliases: ["CVE-2026-126065"]
title: "OpenObserve: empty Basic-auth password accepted, letting attackers log in as users"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openobserve", "package", "self-hosted", "sso"]
not_affected_if: ["no-sso-or-migrated-users", "version-1.1.0-or-later"]
published_at: "2026-11-10T21:19:24+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:47:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126065", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# OpenObserve: empty Basic-auth password accepted, letting attackers log in as users

Link for people: https://infrastack.ai/live/CVE-2026-126065 (this .md is for agents)

OpenObserve accepts an empty or whitespace-only HTTP Basic password for accounts whose stored password_ext is missing or empty, which happens with SSO-provisioned and migrated users. An attacker who knows a user's email and organization can act with that user's role and permissions on protected API routes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenObserve version with the server's version endpoint or binary; versions below `1.1.0` are affected.
- Look for accounts with a missing or empty `password_ext` value, especially SSO-provisioned or migrated users.

## Fix

- Upgrade OpenObserve to `1.1.0` or later.

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126065

## Documents

- [advisory] Vendor advisory: github.com https://github.com/openobserve/openobserve/security/advisories/GHSA-7w4v-2c9r-q94v
- [fix] Patch: github.com https://github.com/openobserve/openobserve/commit/46678ea8daba94c3904286471794f80c5a74ecea
- [fix] Patch: github.com https://github.com/openobserve/openobserve/commit/dc5c657002d97e9e29726cefcadec49cae755e1a
- [fix] Release notes: github.com https://github.com/openobserve/openobserve/releases/tag/v1.1.0

## From the sources

OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_