CVE-2026-63199: Github.com/perses/perses Remote Code Execution Vulnerability

HIGH
Advisory Identifier: GHSA-4227-9989-jrhx
Share
CWE-862
Published
Advisory Summary

CVE-2026-63199 is a HIGH remote code execution vulnerability (CWE-862: Missing Authorization) affecting Github.com/perses/perses libraries in the Go ecosystem. The issue involves perses's missing authorization in datasource proxy allows cross-scope secret disclosure. Remediation is available by upgrading affected packages to version 0.54.0-rc.0.

CVE-2026-63199 at a Glance

CVE Identifier CVE-2026-63199
GHSA Identifier GHSA-4227-9989-jrhx
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-862: Missing Authorization
Affected Product Github.com/perses/perses
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2026-63199

To remediate this vulnerability, upgrade all affected Github.com/perses/perses dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/perses/perses fixed: 0.54.0-rc.0 
Upgrade github.com/perses/perses to 0.54.0-rc.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/perses/perses

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-63199, inspect your project dependencies for Github.com/perses/perses:

inspect dependencies for github.com/perses/perses

Analyze the terminal output to locate any version of Github.com/perses/perses in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.54.0-rc.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-862: Missing Authorization, where the product does not perform an authorization check when an actor attempts to access a resource or perform an action. In Github.com/perses/perses, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check. Datasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret access. The proxy and the service to create a datasource does not verify that the operator has the correct right. A user holding only `GlobalDatasource:create` can create a `GlobalDatasource` and attached to it a `GlobalSecret` without having the right to get access to. The user can also do the same by using the `unSaved datasource` feature proposed by the proxy used to verify the connectivity to the datasource before creating the resource. As soon as you can attach a secret that you don't have right to see, you can then create a Datasource that you control and then read anything send by Perses. Which include the secret in plain text. You can then have access to the secret without being granted to. The project-scoped variant does the same within a project. ### Patches The proxy and the service to create the datasource is verifying if you have the right to read a secret if a secret is attached to the datasource. This is patch in v0.54.0-rc.0 ### Workarounds This issue can be avoided by using the provisioning to create the datasource and by removing the right to create datasource.

CVE-2026-63199 Affected Github.com/perses/perses Versions

1 component(s)
Fixed Versions:
0.54.0-rc.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/perses/perses
golang/github.com/perses/perses
Go
≥ 0.43.0
< 0.54.0-rc.0
0.54.0-rc.0

References

Github.com/perses/perses Source Repository REPOSITORY
https://github.com/perses/perses
Github.com/perses/perses Release RELEASE
https://github.com/perses/perses/releases/tag/v0.54.0-rc.0
GitHub Advisory / Wiki ADVISORY
https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx
Security Fix Commit FIX COMMIT
https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625

Frequently Asked Questions

What is CVE-2026-63199?
CVE-2026-63199 is a security vulnerability in Github.com/perses/perses involving Perses's missing authorization in datasource proxy allows cross-scope secret disclosure under CWE-862: Missing Authorization.
Which Github.com/perses/perses versions are affected?
Affected versions include releases prior to 0.54.0-rc.0 across affected packages: github.com/perses/perses.
What version fixes CVE-2026-63199?
Upgrading to 0.54.0-rc.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/perses/perses affected?
Yes, github.com/perses/perses is affected in releases prior to 0.54.0-rc.0. Upgrade your dependency to 0.54.0-rc.0 or later.
What CWE is associated with CVE-2026-63199?
CVE-2026-63199 is classified under CWE-862: Missing Authorization (The product does not perform an authorization check when an actor attempts to access a resource or perform an action.).
How can I check Go dependencies for CVE-2026-63199?
Run the dependency tree command: 'inspect dependencies for github.com/perses/perses'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4227-9989-jrhx",
  "modified" : "2026-09-18T17:39:48Z",
  "published" : "2026-09-18T17:39:48Z",
  "aliases" : [ "CVE-2026-63199" ],
  "summary" : "Perses's missing authorization in datasource proxy allows cross-scope secret disclosure",
  "details" : "### Impact\n\nThe datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret named in the request body with no Secret-scope check.\n\nDatasource and Secret are distinct, independently grantable role scopes, so an operator can grant datasource access without secret access. The proxy and the service to create a datasource does not verify that the operator has the correct right.\n\nA user holding only `GlobalDatasource:create` can create a `GlobalDatasource` and attached to it a `GlobalSecret` without having the right to get access to. The user can also do the same by using the `unSaved datasource` feature proposed by the proxy used to verify the connectivity to the datasource before creating the resource.\n\nAs soon as you can attach a secret that you don't have right to see, you can then create a Datasource that you control and then read anything send by Perses. Which include the secret in plain text. You can then have access to the secret without being granted to.\n\nThe project-scoped variant does the same within a project.\n\n### Patches\nThe proxy and the service to create the datasource is verifying if you have the right to read a secret if a secret is attached to the datasource.\nThis is patch in v0.54.0-rc.0\n\n### Workarounds\nThis issue can be avoided by using the provisioning to create the datasource and by removing the right to create datasource.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/perses/perses"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.43.0"
      }, {
        "fixed" : "0.54.0-rc.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/perses/perses"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-18T17:39:48Z",
    "nvd_published_at" : null
  }
}