CVE-2026-63199 Details
Description
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately grantable associated project or global Secret before resolving it. A low-privilege user with GlobalDatasource:create or corresponding project datasource creation rights can attach a project or global Secret that the user cannot otherwise read, point the datasource at a service controlled by the user, and cause Perses to send the decrypted secret in plaintext, bypassing project and global scope separation. This issue is fixed in version 0.54.0-rc.0.
A vulnerability in Perses versions 0.43.0 prior to 0.54.0-rc.0 allows for unauthorized access to secrets through the datasource proxy. The issue arises because the proxy authorizes requests based on datasource scope without verifying the caller's permission to read associated secrets. This flaw enables a low-privilege user with rights to create global or project datasources to attach secrets they cannot access, redirect the datasource to a user-controlled service, and receive the decrypted secret in plaintext, thereby bypassing scope separation.
Users can update to Perses version 0.54.0-rc.0 or later, where this vulnerability has been patched. Alternatively, datasources can be created using the provisioning feature, which does not expose this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625 | [email protected] | Source CodeVendor |
| https://github.com/perses/perses/releases/tag/v0.54.0-rc.0 | [email protected] | Release NotesVendor |
| https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Perses | >= 0.43.0, < 0.54.0-rc.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |