{"id":"GO-2026-6514","summary":"Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses","details":"Perses's missing authorization in datasource proxy allows cross-scope secret disclosure in github.com/perses/perses","aliases":["CVE-2026-63199","GHSA-4227-9989-jrhx"],"modified":"2026-09-28T17:00:17.009965174Z","published":"2026-09-28T16:43:40Z","database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6514"},"references":[{"type":"ADVISORY","url":"https://github.com/perses/perses/security/advisories/GHSA-4227-9989-jrhx"},{"type":"FIX","url":"https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"},{"type":"WEB","url":"https://github.com/perses/perses/releases/tag/v0.54.0-rc.0"}],"affected":[{"package":{"name":"github.com/perses/perses","ecosystem":"Go","purl":"pkg:golang/github.com/perses/perses"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.43.0"},{"fixed":"0.54.0-rc.0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6514.json"}}],"schema_version":"1.9.0"}