Perses is vulnerable to an unauthorized sensitive information disclosure flaw that allows low-privilege users to exfiltrate secrets, presenting a high risk to observability infrastructure.

The application fails to perform necessary permission checks when accessing project or global secrets during datasource creation or proxying. This allows an authenticated user with datasource creation rights to point the application to an external service and capture decrypted secrets in plaintext.

The exploitation of this vulnerability results in the compromise of sensitive credentials, which may include database passwords, API keys, or infrastructure secrets stored within the Perses observability platform. Given the CVSS score of 8.3, this high-severity flaw poses a significant risk of lateral movement and broader system compromise. Unauthorized access to these secrets can lead to the total loss of confidentiality for the data streams managed by the observability stack.

Immediate Action: Upgrade the Perses installation to version 0.54.0-rc.0 or later to ensure proper authorization checks are enforced on secret resolution.

Proactive Monitoring: Review audit logs for unusual datasource creation activities or requests to unknown external endpoints that might indicate attempts to exfiltrate secret data.

Compensating Controls: Restrict the ability to create new datasources to a minimal set of trusted administrative users until the upgrade can be performed.

Public Exploit Available: Unknown

This vulnerability represents a critical breakdown in access control that exposes administrative secrets to unauthorized users. Organizations utilizing Perses for observability should treat this as a high-priority remediation task, updating the software immediately to prevent potential credential theft and subsequent unauthorized access to connected infrastructure.