The vulnerability allows any network client to access the /config/runtime endpoint without authentication. The endpoint returns the full server configuration after applying a generic hide_sensitive_fields filter that ignores fields containing "dsn" or "creds", exposing PostgreSQL connection strings such as meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds in plaintext. In addition, the response includes the root administrator email, internal NATS address, filesyste layout, and other deployment details. An attacker that can reach the OpenObserve service can therefore obtain database credentials and other sensitive configuration data, potentially leading to unauthorized database access, full system compromise, and disruption of services. The weakness is an instance of improper information disclosure (CWE-200).

OpenObserve platform from the openobserve vendor. Versions earlier than 0.90.3 contain the unprotected /config/runtime endpoint. The issue is fixed in release v0.90.3 and later.

The CVSS score of 7.5 reflects a high severity impact from the exposed credentials. EPSS is not available, so no exploitation probability is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an unauthenticated network request to the unsecured endpoint. An adversary with network access to the OpenObserve instance can trigger the endpoint and retrieve plain‑text database credentials, potentially facilitating further attacks such as database takeover or lateral movement within the environment. Given the high impact and the ease of exploitation, users are advised to treat this as aposure risk until remediated.