OpenObserve’s enrichment table validator incorrectly accepts IPv6 addresses written with surrounding brackets. This flaw bypasses the built‑in SSRF protection, allowing an authenticated user to supply a URL that resolves to an internal IP. By doing so, the attacker can reach services that are otherwise blocked from external access, including cloud provider metadata endpoints such as AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS, which can expose credentials and other sensitive data.

The vulnerability applies to all OpenObserve installations running version 0.70.3 or earlier. Any deployment using the OpenObserve platform that has not upgraded beyond 0.70.3 is affected, specifically the validate_enrichment_url function in the enrichment table request handler.

The CVSS score of 7.7 places the flaw in the high severity range, yet the EPSS score is below 1%, indicating a low probability of widespread exploitation. The risk is amplified when cloud metadata endpoints are reachable from the OpenObserve instance, and the flaw requires authenticated access to create or modify enrichment URLs, limiting the attack surface compared to publicly exploitable SSRF variants. The flaw is not listed in the CISA KEV catalog.