EUVD-2026-83267
GHSA-4227-9989-jrhx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv attacker (PR:L) remotely reads a Secret from a different, independently-granted scope (S:C, C:H); no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0.
AnalysisAI
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only GlobalDatasource:create or a project-level datasource-creation right to attach a project or global Secret they are not permitted to read to a datasource they control, causing Perses to forward the decrypted secret in plaintext to an attacker-operated endpoint. Exploitation requires an account with datasource-create permission in a deployment where Datasource and Secret scopes are separately granted, plus the ability to point the datasource at attacker-controlled infrastructure; the vendor fix enforces a Secret read-permission check on both the datasource-creation service and the unsaved-datasource proxy paths, and older releases can be fully protected by creating datasources via provisioning and revoking the datasource-create right. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Perses account holding GlobalDatasource:create or project-level datasource-creation permission, in a deployment where Datasource and Secret scopes are separately granted (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded authorization flaw (CWE-862). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Perses to 0.54.0-rc.0 or later, which is the first release containing the fix (Vendor-released patch: 0.54.0-rc.0) and is documented at https://github.com/perses/perses/releases/tag/v0.54.0-rc.0; the substantive change is in commit https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625, which adds a Secret read-permission check before any secret is decrypted on the datasource-creation service and the unsaved-datasource proxy paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Perses instances and confirm which run versions 0.43.0 through 0.54.0-rc.0; where datacenter or project-level datasource-creation rights (GlobalDatasource:create or equivalent project datasource-create) are granted separately from Secret read rights, immediately revoke those rights from all non-administrative users and service accounts, and audit recent datasource configurations for URLs pointing to unexpected or external endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
zot container registry versions prior to 2.1.18 mis-map the HTTP DELETE method to the "push" scope action in its bearer
Same weakness CWE-862 – Missing Authorization
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today