CVE-2026-39361

OVERVIEW CVE-2026-39361 affects OpenObserve version 0.70.3 and earlier, a cloud-native observability platform. The vulnerability exists in the validate_enrichment_url function, which improperly validates IPv6 addresses due to a parsing error in Rust's URL crate that returns IPv6 addresses with surrounding brackets. This validation bypass allows authenticated attackers to bypass IP-based access controls designed to block internal service access. SEVERITY The vulnerability carries a CVSS score of 7.7 (HIGH) with a network-based attack vector requiring low complexity and valid authentication credentials. The impact is significant on cloud deployments, where attackers can access AWS IMDSv1, GCP metadata services, or Azure IMDS endpoints to retrieve sensitive IAM credentials. On self-hosted deployments, the vulnerability enables reconnaissance and probing of internal network services, potentially leading to further compromise of backend infrastructure. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and community attention remains limited, as reflected in the low EPSS score of 0.00035. No publicly available exploit code has been widely circulated, though the straightforward nature of the vulnerability suggests exploitation would be relatively straightforward for authenticated users with knowledge of the flaw.