https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 03:25:41 +0000 https://cve.radiocsirt.org/vuln/cve-2026-39361 <p><strong>Affected:</strong> openobserve</p> <p>OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust&#39;s url crate returns them with surrounding brackets (e.g. &#34;[::1]&#34; not &#34;::1&#34;). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.</p> <p><strong>Affected:</strong> openobserve</p> <p>OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust&#39;s url crate returns them with surrounding brackets (e.g. &#34;[::1]&#34; not &#34;::1&#34;). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.</p> https://cve.radiocsirt.org/vuln/cve-2026-39361