CVE-2026-63199

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63199", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T22:13:00.722Z", "datePublished": "2026-09-18T17:36:05.256Z", "dateUpdated": "2026-09-24T21:05:26.515Z"}, "containers": {"cna": {"title": "Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"}, {"name": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625", "tags": ["x_refsource_MISC"], "url": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"}, {"name": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"}], "affected": [{"vendor": "perses", "product": "perses", "versions": [{"version": ">= 0.43.0, < 0.54.0-rc.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T17:36:05.256Z"}, "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0."}], "source": {"advisory": "GHSA-4227-9989-jrhx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-24T21:01:42.526103Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T21:05:26.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-24T21:01:42.526103Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T21:03:53.908Z"}}], "cna": {"title": "Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure", "source": {"advisory": "GHSA-4227-9989-jrhx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "perses", "product": "perses", "versions": [{"status": "affected", "version": ">= 0.43.0, < 0.54.0-rc.0"}]}], "references": [{"url": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx", "name": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625", "name": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0", "name": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T17:36:05.256Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63199", "state": "PUBLISHED", "dateUpdated": "2026-09-24T21:05:26.515Z", "dateReserved": "2026-07-15T22:13:00.722Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-18T17:36:05.256Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "perses", "vendor": "perses", "versions": [{"status": "affected", "version": ">= 0.43.0, < 0.54.0-rc.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0."}], "id": "CVE-2026-63199", "lastModified": "2026-09-30T17:32:07.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63199", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T21:01:42.526103Z", "version": "2.0.3"}}]}, "published": "2026-09-18T18:17:09.980", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"}, {"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/perses/perses: Perses: Cross-scope secret disclosure due to missing authorization in datasource proxy", "id": "2538881", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538881"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-1220", "details": ["Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0.", "A flaw was found in Perses, an open-source dashboard and visualization project. A low-privilege user with datasource creation rights can exploit a missing authorization check in the datasource proxy. This allows the user to attach a project or global secret they cannot otherwise read and cause Perses to send the decrypted secret in plaintext to a service controlled by the attacker. This bypasses project and global scope separation, leading to the disclosure of sensitive information."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available for this vulnerability. Red Hat recommends applying the available security update when it becomes available."}, "name": "CVE-2026-63199", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/acm-multicluster-observability-addon-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-09-18T17:36:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63199\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63199\nhttps://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625\nhttps://github.com/perses/perses/releases/tag/v0.54.0-rc.0\nhttps://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"], "statement": "This Important vulnerability in Perses allows a low-privilege user with datasource creation rights to disclose secrets they are not authorized to read. By attaching a restricted secret to a user-controlled datasource, the Perses proxy can be coerced into sending the decrypted secret in plaintext, bypassing intended access controls. This risk is present in Red Hat products utilizing Perses where users have permissions to create or modify datasources.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.43.0,0.54.0-rc.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "perses", "source": "cna", "vendor": "perses"}, "product": "perses", "vendor": "perses"}], "created": "2026-09-19T12:00:08.779171+00:00", "updated": "2026-09-23T16:30:08.022734+00:00", "vendors": ["perses", "perses$PRODUCT$perses"]}