CVE-2025-64744: low-severity vulnerability in openobserve
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.5epss 0.2%
OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected products
openobserve · openobserveRelated CVEs — openobserve
In the same product, most dangerous first.
CVE-2024-24830CRITICALOpenObserve Privilege Escalation Vulnerability in Users APIEPSS 0.7%CVE-2024-41808HIGHOpenObserve stored XSS vulnerability may lead to complete account takeoverEPSS 0.5%CVE-2024-55954HIGHOpenObserve Improper Authorization Allows Admin User to Remove Root UserEPSS 0.5%CVE-2024-25106CRITICALOpenObserve Unauthorized Access Vulnerability in Users APIEPSS 0.5%CVE-2024-41809HIGHOpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`EPSS 0.4%CVE-2026-63645HIGHOpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentialsEPSS 0.3%