Perses v0.54.0-rc.0 fixes secret disclosure vulnerability

The Perses project has addressed a high-severity security vulnerability in its datasource proxy with the release of version v0.54.0-rc.0, according to the GitHub Security Advisory database. The issue stemmed from missing authorization checks in the proxy, which allowed users with `GlobalDatasource:create` permissions to attach secrets they were not authorized to access to datasources. This could lead to unauthorized disclosure of sensitive information, as the proxy would decrypt and expose secrets without verifying the user's secret-scope permissions.

The patch ensures that the proxy and datasource creation service now verify whether the user has the appropriate rights to read a secret before attaching it to a datasource. Operators are advised to upgrade to v0.54.0-rc.0 to mitigate this vulnerability. Alternatively, the advisory suggests using provisioning to create datasources and revoking permissions for datasource creation as a temporary workaround.

Before upgrading, operators should carefully review their existing role-based access control configurations. If the vulnerability has been exploited, unauthorized access to secrets may have already occurred, necessitating a review of exposed secrets and potential rotation. This issue highlights the importance of granular authorization checks in systems where distinct scopes govern access to sensitive resources.