https://vulnerability.circl.lu/sightings/feed 2026-09-20T14:25:19.191951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/27a7238d-e905-4251-8545-fc8c60184431/export 2026-09-20T14:25:19.211847+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "27a7238d-e905-4251-8545-fc8c60184431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63199", "type": "seen", "source": "https://gist.github.com/alon710/de46e4b55e23d058335a512366f2ab2a", "content": "# CVE-2026-63199: CVE-2026-63199: Cross-Scope Secret Disclosure via Missing Authorization in Perses Datasource Proxy\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63199\n\n## Summary\nCVE-2026-63199 is a critical missing authorization vulnerability (CWE-862) in Perses versions 0.43.0 to 0.54.0-rc.0. It allows low-privileged attackers to retrieve and exfiltrate highly sensitive credentials (secrets) from different scopes by configuring a malicious datasource pointing to an attacker-controlled endpoint.\n\n## TL;DR\nA missing authorization check in Perses' datasource proxy allows low-privileged users to exfiltrate database and system credentials to external servers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS Score**: 8.3 (High)\n- **EPSS Score**: 0.00 (New/Unlisted)\n- **Primary Impact**: Cross-Scope Secret Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Perses\n- **Perses**: >= 0.43.0, < 0.54.0-rc.0 (Fixed in: `0.54.0-rc.0`)\n\n## Mitigation\n\n- Upgrade Perses to version 0.54.0-rc.0 or higher.\n- Restrict creation and modification of Datasources/GlobalDatasources to trusted administrators.\n- Implement egress network filtering on the Perses server to block external connections to unapproved targets.\n- Rotate all credentials, API keys, and connection passwords saved inside the Perses Secret store.\n\n**Remediation Steps:**\n1. Identify current Perses version using the administrative dashboard or server logs.\n2. Schedule maintenance window and download Perses v0.54.0-rc.0 or a later stable release.\n3. Audit existing saved Datasources in the Perses database to detect any unauthorized secret mappings.\n4. Deploy the updated Perses binary/container and verify API logs for correct permission enforcement.\n5. Establish egress firewall rules restricting outbound connections from the Perses gateway host.\n\n## References\n\n- [NVD - CVE-2026-63199](https://nvd.nist.gov/vuln/detail/CVE-2026-63199)\n- [GitHub Security Advisory GHSA-4227-9989-jrhx](https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx)\n- [Perses Fix Commit](https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63199) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T05:32:22.156134Z"} 2026-09-19T05:32:22.156134+00:00