EUVD-2026-36760
GHSA-wx3j-9c6v-jj86
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable CSV export leaks sensitive logs (C:H) with no integrity/availability impact; PR:N retained per description but plausibly PR:L if export requires a session.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.
AnalysisAI
Information disclosure in Observe (the Observeinc observability/log-analytics platform) versions dated 2026-01-28 and earlier allows remote attackers to obtain sensitive data through the CSV Log export component. Rated CVSS 7.5 with a high-confidentiality, no-integrity/availability impact, the flaw exposes log contents that may include secrets, PII, or operational telemetry. Publicly available exploit code exists (SSVC 'poc') and CISA's SSVC framework marks it automatable, though EPSS remains very low at 0.18% (8th percentile) and it is not on the CISA KEV list.
Technical ContextAI
Observe is a SaaS-style observability and log-analytics platform that ingests, indexes, and lets users query machine and application logs. The vulnerable surface is the CSV Log export component - the feature that serializes queried log data into downloadable CSV files. The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the export path returns log data to an actor who should not be able to read it, likely through missing or insufficient access controls / tenant or authorization scoping on the export endpoint. Because logs frequently carry credentials, tokens, session data, and PII, an information-exposure defect in the export path can leak highly sensitive material. Note the CPE string in the feed is a placeholder ('cpe:2.3:a:n/a:n/a') and provides no version enumeration.
RemediationAI
No vendor-released patch identified at time of analysis; no fix version is present in the available data. Because Observe is primarily a hosted/SaaS observability platform, the most likely remediation path is a vendor-side update - contact Observe support/security and confirm whether the CSV Log export fix has been deployed to your tenant. As compensating controls until a fix is confirmed: restrict or disable the CSV Log export feature for non-privileged roles (trade-off: analysts lose bulk export/offline reporting); tighten authorization and tenant-scoping on export functionality and review who holds export permissions; and place the export/query endpoints behind network restrictions or SSO/IP allow-listing where the deployment model permits (trade-off: may block legitimate remote analysts). Monitor export activity logs for anomalous or high-volume CSV downloads. Track the reference at https://nvd.nist.gov/vuln/detail/CVE-2026-39007 and the researcher publication at https://github.com/Kettn/Vulnerability_Publications/tree/main/CVE-2026-39007 for an official patched version.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today