A critical SSRF vulnerability in OpenObserve allows authenticated attackers to bypass network restrictions and potentially exfiltrate sensitive cloud environment credentials.

The validate_enrichment_url function fails to properly sanitize IPv6 addresses due to how the underlying Rust url crate handles brackets. This flaw permits an authenticated user to perform requests against internal services or cloud metadata endpoints like AWS IMDSv1.

The ability to perform SSRF against cloud metadata services poses a severe risk to organizational security. An attacker could retrieve IAM credentials, leading to full cloud account compromise, data exfiltration, or unauthorized infrastructure changes. The CVSS score of 7.7 reflects the high impact on confidentiality in cloud-native environments, necessitating immediate attention.

Immediate Action: Upgrade OpenObserve to a version beyond 0.70.3 where the URL validation logic has been corrected.

Proactive Monitoring: Review web access logs for unusual outbound requests originating from the OpenObserve server, particularly those targeting internal IP ranges or metadata service addresses (169.254.169.254).

Compensating Controls: Implement strict egress filtering on the host machine to block access to internal metadata services and private network segments that the application does not strictly require.

Public Exploit Available: Unknown

Given the potential for complete cloud environment compromise, this vulnerability should be prioritized for immediate remediation. Organizations should verify their current deployment versions and apply the necessary patches as soon as they are available from the vendor, while simultaneously auditing their cloud instance permissions to follow the principle of least privilege.