{"metadata": {"vulnerability": "CVE-2026-63458", "count": 22, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 16}}, "data": [{"timestamp": "2026-07-16T21:37:45.768Z", "date_only": false, "value": "2026-07-16T21:37:45.768Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63458", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-31T00:00:00Z", "date_only": false, "value": "2026-07-31T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-16T20:21:44Z", "date_only": false, "value": "2026-09-16T20:21:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-16T21:24:24Z", "date_only": false, "value": "2026-09-16T21:24:24Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-17T17:17:28Z", "date_only": false, "value": "2026-09-17T17:17:28Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-18T17:32:54.847Z", "date_only": false, "value": "2026-09-18T17:32:54.847Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63458", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-18T17:33:16.974Z", "date_only": false, "value": "2026-09-18T17:33:16.974Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63458", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:39:31Z", "date_only": false, "value": "2026-09-18T17:39:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CJGJ-2FWF-4C2W", "record": "GHSA-CJGJ-2FWF-4C2W", "field": "published"}, {"timestamp": "2026-09-18T17:40:32Z", "date_only": false, "value": "2026-09-18T17:40:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CJGJ-2FWF-4C2W", "record": "GHSA-CJGJ-2FWF-4C2W", "field": "modified"}, {"timestamp": "2026-09-18T18:17:10.643Z", "date_only": false, "value": "2026-09-18T18:17:10.643", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63458", "record": "FKIE_CVE-2026-63458", "field": "published"}, {"timestamp": "2026-09-18T19:50:23.078Z", "date_only": false, "value": "2026-09-18T19:50:23.078796Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63458", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-18T19:50:23.078Z", "date_only": false, "value": "2026-09-18T19:50:23.078796Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63458", "record": "FKIE_CVE-2026-63458", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-18T19:50:33.901Z", "date_only": false, "value": "2026-09-18T19:50:33.901Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63458", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T19:50:33.901Z", "date_only": false, "value": "2026-09-18T19:50:33.901Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63458", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-19T06:32:20.319Z", "date_only": false, "value": "2026-09-19T06:32:20.319078Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/0b31ec47bc74ca943ea96e388e1d1f47", "record": "CVE-2026-63458", "field": "creation_timestamp", "uuid": "2c8b69cf-ba53-477d-b2a0-d87b7bcd5b29", "content": "# CVE-2026-63458: CVE-2026-63458: Broken Object Level Authorization (BOLA) and Tenant Isolation Bypass in Perses\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63458\n\n## Summary\nAn authorization bypass and tenant isolation vulnerability in Perses prior to version 0.54.0-beta.3 allows authenticated viewers to access unauthorized project resources by manipulating query parameters or querying unmapped ephemeral endpoints.\n\n## TL;DR\nAuthenticated users with viewer access can bypass tenant boundaries and view configurations of unauthorized projects due to inconsistent parameter evaluation in Perses backend services.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.0\n- **Impact**: Confidentiality High (VC:H)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Perses Observability Platform\n- **perses**: < 0.54.0-beta.3 (Fixed in: `0.54.0-beta.3`)\n\n## Mitigation\n\n- Upgrade to version 0.54.0-beta.3 or later\n- Deploy WAF rules to detect and drop mismatched path/query parameters\n- Monitor application logs for HTTP 400 validation failures\n\n**Remediation Steps:**\n1. Identify all deployed Perses instances running versions older than 0.54.0-beta.3\n2. Apply the patch by updating the container image or application binary to version 0.54.0-beta.3\n3. Verify access controls by attempting a cross-project query using an authorized account\n4. Review access logs for occurrences of mismatched 'project' values\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w)\n- [Remediation Fix Commit](https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540)\n- [Release Tag Details](https://github.com/perses/perses/releases/tag/v0.54.0-beta.3)\n- [NVD Vulnerability Record](https://nvd.nist.gov/vuln/detail/CVE-2026-63458)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-63458)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63458) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/0b31ec47bc74ca943ea96e388e1d1f47"}, {"timestamp": "2026-09-19T08:19:45Z", "date_only": false, "value": "2026-09-19T08:19:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-09-20T21:49:08Z", "date_only": false, "value": "2026-09-20T21:49:08Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-09-20T21:49:08Z", "date_only": false, "value": "2026-09-20T21:49:08Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11413-1", "record": "OPENSUSE-SU-2026:11413-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-23T18:12:04.247Z", "date_only": false, "value": "2026-09-23T18:12:04.247", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63458", "record": "FKIE_CVE-2026-63458", "field": "lastModified"}]}