DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63199: CVE-2026-63199: Cross-Scope Secret Disclosure via Missing Authorization in Perses Datasource Proxy

#security #cve #cybersecurity

CVE-2026-63199: Cross-Scope Secret Disclosure via Missing Authorization in Perses Datasource Proxy

Vulnerability ID: CVE-2026-63199
CVSS Score: 8.3
Published: 2026-09-18

CVE-2026-63199 is a critical missing authorization vulnerability (CWE-862) in Perses versions 0.43.0 to 0.54.0-rc.0. It allows low-privileged attackers to retrieve and exfiltrate highly sensitive credentials (secrets) from different scopes by configuring a malicious datasource pointing to an attacker-controlled endpoint.

TL;DR

A missing authorization check in Perses' datasource proxy allows low-privileged users to exfiltrate database and system credentials to external servers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network
  • CVSS Score: 8.3 (High)
  • EPSS Score: 0.00 (New/Unlisted)
  • Primary Impact: Cross-Scope Secret Disclosure
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Perses
  • Perses: >= 0.43.0, < 0.54.0-rc.0 (Fixed in: 0.54.0-rc.0)

Code Analysis

Commit: 2368c9e

Fix authorization bypass on datasource proxy secret resolution

Mitigation Strategies

  • Upgrade Perses to version 0.54.0-rc.0 or higher.
  • Restrict creation and modification of Datasources/GlobalDatasources to trusted administrators.
  • Implement egress network filtering on the Perses server to block external connections to unapproved targets.
  • Rotate all credentials, API keys, and connection passwords saved inside the Perses Secret store.

Remediation Steps:

  1. Identify current Perses version using the administrative dashboard or server logs.
  2. Schedule maintenance window and download Perses v0.54.0-rc.0 or a later stable release.
  3. Audit existing saved Datasources in the Perses database to detect any unauthorized secret mappings.
  4. Deploy the updated Perses binary/container and verify API logs for correct permission enforcement.
  5. Establish egress firewall rules restricting outbound connections from the Perses gateway host.

References

Read the full report for CVE-2026-63199 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)