CVE-2026-63458: Broken Object Level Authorization (BOLA) and Tenant Isolation Bypass in Perses
Vulnerability ID: CVE-2026-63458
CVSS Score: 7.1
Published: 2026-09-18
An authorization bypass and tenant isolation vulnerability in Perses prior to version 0.54.0-beta.3 allows authenticated viewers to access unauthorized project resources by manipulating query parameters or querying unmapped ephemeral endpoints.
TL;DR
Authenticated users with viewer access can bypass tenant boundaries and view configurations of unauthorized projects due to inconsistent parameter evaluation in Perses backend services.
Technical Details
- CWE ID: CWE-639
- Attack Vector: Network (AV:N)
- CVSS Score: 7.1
- EPSS Score: 0.0
- Impact: Confidentiality High (VC:H)
- Exploit Status: none
- KEV Status: Not Listed
Affected Systems
- Perses Observability Platform
-
perses: < 0.54.0-beta.3 (Fixed in:
0.54.0-beta.3)
Code Analysis
Commit: 8015fb3
Fix project isolation and authorize project-scoped list endpoints
Mitigation Strategies
- Upgrade to version 0.54.0-beta.3 or later
- Deploy WAF rules to detect and drop mismatched path/query parameters
- Monitor application logs for HTTP 400 validation failures
Remediation Steps:
- Identify all deployed Perses instances running versions older than 0.54.0-beta.3
- Apply the patch by updating the container image or application binary to version 0.54.0-beta.3
- Verify access controls by attempting a cross-project query using an authorized account
- Review access logs for occurrences of mismatched 'project' values
References
- Official GitHub Security Advisory
- Remediation Fix Commit
- Release Tag Details
- NVD Vulnerability Record
- CVE.org Record
Read the full report for CVE-2026-63458 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)