CVE-2026-63458

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63458", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T21:37:45.768Z", "datePublished": "2026-09-18T17:32:54.847Z", "dateUpdated": "2026-09-18T19:50:33.901Z"}, "containers": {"cna": {"title": "Perses project query parameter authorization bypass exposes cross-project resources", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w"}, {"name": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540", "tags": ["x_refsource_MISC"], "url": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540"}, {"name": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3"}], "affected": [{"vendor": "perses", "product": "perses", "versions": [{"version": "< 0.54.0-beta.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T17:33:16.974Z"}, "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3."}], "source": {"advisory": "GHSA-cjgj-2fwf-4c2w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T19:50:23.078796Z", "id": "CVE-2026-63458", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:50:33.901Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63458", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T19:50:23.078796Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:50:29.857Z"}}], "cna": {"title": "Perses project query parameter authorization bypass exposes cross-project resources", "source": {"advisory": "GHSA-cjgj-2fwf-4c2w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "perses", "product": "perses", "versions": [{"status": "affected", "version": "< 0.54.0-beta.3"}]}], "references": [{"url": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w", "name": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540", "name": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3", "name": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T17:33:16.974Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63458", "state": "PUBLISHED", "dateUpdated": "2026-09-18T19:50:33.901Z", "dateReserved": "2026-07-16T21:37:45.768Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-18T17:32:54.847Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "perses", "vendor": "perses", "versions": [{"status": "affected", "version": "< 0.54.0-beta.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3."}], "id": "CVE-2026-63458", "lastModified": "2026-09-23T18:12:04.247", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63458", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T19:50:23.078796Z", "version": "2.0.3"}}]}, "published": "2026-09-18T18:17:10.643", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540"}, {"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/perses/perses: Perses: Information disclosure via query parameter authorization bypass", "id": "2538379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538379"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.", "A flaw was found in Perses. An authenticated user with viewer access to one project can bypass authorization checks by manipulating the project query parameter on project-scoped list endpoints. This allows them to access and view resources, such as dashboards, datasources, and variables, belonging to other projects without proper authorization. This leads to information disclosure and a breach of tenant isolation, exposing complete resource specifications."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-63458", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-multicluster-observability-addon-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-09-18T17:32:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63458\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63458\nhttps://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540\nhttps://github.com/perses/perses/releases/tag/v0.54.0-beta.3\nhttps://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w"], "statement": "This Moderate impact information disclosure flaw in Perses, as used in Red Hat Advanced Cluster Management for Kubernetes, allows an authenticated user with viewer access to one project to bypass authorization and view resources from other projects. The vulnerability is rated Moderate due to the prerequisite of existing authenticated access and the nature of the information disclosure, which does not lead to arbitrary code execution or privilege escalation.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.54.0-beta.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "perses", "source": "cna", "vendor": "perses"}, "product": "perses", "vendor": "perses"}], "created": "2026-09-19T12:00:08.779339+00:00", "updated": "2026-09-21T10:04:23.409209+00:00", "vendors": ["perses", "perses$PRODUCT$perses"]}