CVE-2026-63199 — perses
Fix: perses/perses@2368c9eCVE-2026-63199 is a CWE-862 vulnerability in github.com/perses/perses. A fix is available for github.com/perses/perses — see the affected versions and patch details below.
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
Real-World Exposure
github.com/perses/persesReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check.
Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret access. The proxy and the service to create a datasource does not verify that the operator has the correct right.
A user holding only GlobalDatasource:create can create a GlobalDatasource and attached to it a GlobalSecret without having the right to get access to. The user can also do the same by using the unSaved datasource feature proposed by the proxy used to verify the connectivity to the datasource before creating the resource.
As soon as you can attach a secret that you don't have right to see, you can then create a Datasource that you control and then read anything send by Perses. Which include the secret in plain text. You can then have access to the secret without being granted to.
The project-scoped variant does the same within a project.
Patches
The proxy and the service to create the datasource is verifying if you have the right to read a secret if a secret is attached to the datasource. This is patch in v0.54.0-rc.0
Workarounds
This issue can be avoided by using the provisioning to create the datasource and by removing the right to create datasource.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/perses/perses | ≥ 0.43.0&&< 0.54.0-rc.0 | 0.54.0-rc.0go get github.com/perses/perses@v0.54.0-rc.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/perses/perses, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/perses/perses to 0.54.0-rc.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-63199 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-63199 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-63199. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-63199 in your dependencies?
O3 Security finds CVE-2026-63199 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.