CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6723 vulnerabilities reference this CWE, most recent first.
GHSA-32RV-JJCF-CMRM
Vulnerability from github – Published: 2024-02-26 18:30 – Updated: 2024-02-26 18:30The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL
http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
which is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.
The user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper iptable or firewall rule is not configured for their setup.
{
"affected": [],
"aliases": [
"CVE-2024-0455"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:50Z",
"severity": "CRITICAL"
},
"details": "The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL\n```\nhttp://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance\n```\nwhich is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.\n\nThe user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup.",
"id": "GHSA-32rv-jjcf-cmrm",
"modified": "2024-02-26T18:30:29Z",
"published": "2024-02-26T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0455"
},
{
"type": "WEB",
"url": "https://github.com/mintplex-labs/anything-llm/commit/b2b2c2afe15c48952d57b4d01e7108f9515c5f55"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/07d83b49-7ebb-40d2-83fc-78381e3c5c9c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3325-26CH-Q5P3
Vulnerability from github – Published: 2024-06-25 21:31 – Updated: 2024-08-21 15:30In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.
{
"affected": [],
"aliases": [
"CVE-2024-5014"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-25T21:16:00Z",
"severity": "HIGH"
},
"details": "In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the\u00a0GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form.",
"id": "GHSA-3325-26ch-q5p3",
"modified": "2024-08-21T15:30:49Z",
"published": "2024-06-25T21:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5014"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024"
},
{
"type": "WEB",
"url": "https://www.progress.com/network-monitoring"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3325-V43H-43RV
Vulnerability from github – Published: 2026-10-01 15:21 – Updated: 2026-10-01 15:21JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than as a package.
cmdline = [
sys.executable,
"-m",
"pip",
"uninstall",
"--yes",
"--no-input",
extension,
]
An extension name of the form -r followed by a path therefore made pip open that path as a requirements file. pip's parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.
This has security implications only for deployments that combine all of the following:
- the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip;
- an authenticated account permitted to call the extension API; and
- kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)
Unlike GHSA-37w4-hwhx-4rc4 and GHSA-89vp-jrxv-24w8, this does not need an allowlist or blocklist to be configured. The uninstall path never consulted the listing.
Impact
An authenticated user gains a read of server-side files and an outbound request from the server, both outside the confinement that the contents root and the disabled kernels were meant to provide. The user cannot choose which line of a file is returned, and cannot write content of their choosing.
Reading files the account cannot reach
-r<path> makes pip open the path as a requirements file. The first line that pip cannot parse as a requirement comes back in the response together with the path. Blank lines and # comments are skipped. A line that is a valid package name is accepted silently, and the request answers 201 with no message, so a secret made only of letters, digits, dots, hyphens and underscores is not disclosed. One line is returned per request, and the requester cannot select which one.
The same option distinguishes a missing path ([Errno 2] No such file or directory), an unreadable one ([Errno 13] Permission denied) and a directory ([Errno 21] Is a directory), so any path on the host can be probed for existence and readability.
Reaching hosts and ports the account cannot reach
-r also accepts a URL. pip fetches it with an ordinary GET from the server's network position and reflects the first unparsable line of the response body the same way. A response whose body is a single line comes back in full. In a deployment where the single-user server sits inside a private network, this reaches internal services and cloud instance metadata endpoints that the user has no other route to.
Writing files
--log=<path> makes pip create that file if it is absent and append its own log to it otherwise. The content is pip's log text, not text the requester chooses, so the effect is to create files at chosen paths and to corrupt a file that has to parse, such as a configuration file read at the next start.
What this does not add
The same endpoint already uninstalls any installed package when it is given an ordinary, valid package name, so the injection adds no availability impact beyond what the extension manager already permits. Deployments that treat that as unacceptable should use the read-only extension manager, as described below.
pip refuses --python after a subcommand name, and ignores editable entries in an uninstall requirements file, so neither gives code execution.
Patches
JupyterLab v4.6.4 and v4.5.11 contain the patch. The uninstall name is now validated as a PyPI package name in both the HTTP handler and PyPIExtensionManager.uninstall, and the pip command line carries an explicit -- before the package operand.
Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.
Workarounds
Deployments wanting to disable programmatic extension installation and removal entirely can switch to the read-only extension manager:
--LabApp.extension_manager=readonly
or the following traitlet:
c.LabApp.extension_manager = 'readonly'
You can confirm that the read-only manager is in use from GUI:
Users lose the ability to install and remove extensions from the Extension Manager; extensions must then be installed by an administrator in the environment.
Note: an egress policy that blocks outbound requests from the single-user server limits the reach of the URL variant, but does not address the file read or the file write.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.6.3"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.5.10"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-102904"
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-88",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-01T15:21:17Z",
"nvd_published_at": "2026-09-29T21:17:18Z",
"severity": "MODERATE"
},
"details": "JupyterLab\u0027s PyPI extension manager runs `python -m pip uninstall` with the extension name taken from the request body. `ExtensionHandler.post` validates the name for `cmd=install` but not for `cmd=uninstall`, so a name that begins with `-` reaches the command line and pip reads it as an option rather than as a package.\n\n```python\ncmdline = [\n sys.executable,\n \"-m\",\n \"pip\",\n \"uninstall\",\n \"--yes\",\n \"--no-input\",\n extension,\n]\n```\n\nAn extension name of the form `-r` followed by a path therefore made pip open that path as a requirements file. pip\u0027s parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.\n\nThis has security implications only for deployments that combine all of the following:\n\n- the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip;\n- an authenticated account permitted to call the extension API; and\n- kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)\n\nUnlike [GHSA-37w4-hwhx-4rc4](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4) and [GHSA-89vp-jrxv-24w8](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8), this does not need an allowlist or blocklist to be configured. The uninstall path never consulted the listing.\n\n### Impact\n\nAn authenticated user gains a read of server-side files and an outbound request from the server, both outside the confinement that the contents root and the disabled kernels were meant to provide. The user cannot choose which line of a file is returned, and cannot write content of their choosing.\n\n#### Reading files the account cannot reach\n\n`-r\u003cpath\u003e` makes pip open the path as a requirements file. The first line that pip cannot parse as a requirement comes back in the response together with the path. Blank lines and `#` comments are skipped. A line that is a valid package name is accepted silently, and the request answers 201 with no message, so a secret made only of letters, digits, dots, hyphens and underscores is not disclosed. One line is returned per request, and the requester cannot select which one.\n\nThe same option distinguishes a missing path (`[Errno 2] No such file or directory`), an unreadable one (`[Errno 13] Permission denied`) and a directory (`[Errno 21] Is a directory`), so any path on the host can be probed for existence and readability.\n\n#### Reaching hosts and ports the account cannot reach\n\n`-r` also accepts a URL. pip fetches it with an ordinary GET from the server\u0027s network position and reflects the first unparsable line of the response body the same way. A response whose body is a single line comes back in full. In a deployment where the single-user server sits inside a private network, this reaches internal services and cloud instance metadata endpoints that the user has no other route to.\n\n#### Writing files\n\n`--log=\u003cpath\u003e` makes pip create that file if it is absent and append its own log to it otherwise. The content is pip\u0027s log text, not text the requester chooses, so the effect is to create files at chosen paths and to corrupt a file that has to parse, such as a configuration file read at the next start.\n\n#### What this does not add\n\nThe same endpoint already uninstalls any installed package when it is given an ordinary, valid package name, so the injection adds no availability impact beyond what the extension manager already permits. Deployments that treat that as unacceptable should use the read-only extension manager, as described below.\n\npip refuses `--python` after a subcommand name, and ignores editable entries in an uninstall requirements file, so neither gives code execution.\n\n### Patches\n\nJupyterLab [`v4.6.4`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4) and [`v4.5.11`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11) contain the patch. The uninstall name is now validated as a PyPI package name in both the HTTP handler and `PyPIExtensionManager.uninstall`, and the pip command line carries an explicit `--` before the package operand.\n\nUsers of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.\n\n### Workarounds\n\nDeployments wanting to disable programmatic extension installation and removal entirely can switch to the read-only extension manager:\n\n```bash\n--LabApp.extension_manager=readonly\n```\n\nor the following traitlet:\n\n```python\nc.LabApp.extension_manager = \u0027readonly\u0027\n```\n\nYou can confirm that the read-only manager is in use from GUI:\n\n\u003cimg width=\"293\" height=\"293\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8016c809-633e-4ed0-a5bc-6bc4793caa0f\" /\u003e\n\nUsers lose the ability to install and remove extensions from the Extension Manager; extensions must then be installed by an administrator in the environment.\n\nNote: an egress policy that blocks outbound requests from the single-user server limits the reach of the URL variant, but does not address the file read or the file write.",
"id": "GHSA-3325-v43h-43rv",
"modified": "2026-10-01T15:21:17Z",
"published": "2026-10-01T15:21:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102904"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/9e1951e57da499ca66ef5e0caf68e71ad2e3d1a5"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyterlab/jupyterlab"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs"
}
GHSA-336J-RXWX-RPCM
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 18:31A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf_proxy.py of the component URL Handler. The manipulation of the argument make_request leads to server-side request forgery. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-2711"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T08:16:16Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf_proxy.py of the component URL Handler. The manipulation of the argument make_request leads to server-side request forgery. The attack can be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-336j-rxwx-rpcm",
"modified": "2026-02-19T18:31:51Z",
"published": "2026-02-19T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2711"
},
{
"type": "WEB",
"url": "https://github.com/zhutoutoutousan/worldquant-miner/issues/100"
},
{
"type": "WEB",
"url": "https://github.com/zhutoutoutousan/worldquant-miner/issues/100#issue-3905756578"
},
{
"type": "WEB",
"url": "https://github.com/zhutoutoutousan/worldquant-miner"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.346662"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.346662"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.753320"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-336R-GXPP-8VJ2
Vulnerability from github – Published: 2021-12-02 00:00 – Updated: 2021-12-03 00:00IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.
{
"affected": [],
"aliases": [
"CVE-2021-29863"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-01T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. This vulnerability is due to an incomplete fix for CVE-2020-4786. IBM X-Force ID: 206087.",
"id": "GHSA-336r-gxpp-8vj2",
"modified": "2021-12-03T00:00:34Z",
"published": "2021-12-02T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29863"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206087"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6520490"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-337W-XF2Q-H5W2
Vulnerability from github – Published: 2026-04-20 09:30 – Updated: 2026-04-20 09:30A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-6618"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-20T09:16:09Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function parse_openai_plugin_json_to_tool_bundle of the file api/core/tools/utils/parser.py of the component ApiBasedToolSchemaParser. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-337w-xf2q-h5w2",
"modified": "2026-04-20T09:30:45Z",
"published": "2026-04-20T09:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6618"
},
{
"type": "WEB",
"url": "https://gist.github.com/chenhouser2025/d7b1c574b0e32eb9169f7046b486e662"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/792241"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358253"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/358253/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-338X-HFX8-VX9X
Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2025-02-13 18:59This issue affects all versions of Apache Karaf Cave.
As this project is retired, there are no plans to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf:cave"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-34365"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:37:05Z",
"nvd_published_at": "2024-05-14T15:38:46Z",
"severity": "CRITICAL"
},
"details": "This issue affects all versions of Apache Karaf Cave.\n\nAs this project is retired, there are no plans to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"id": "GHSA-338x-hfx8-vx9x",
"modified": "2025-02-13T18:59:48Z",
"published": "2024-05-14T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34365"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/karaf-cave"
},
{
"type": "WEB",
"url": "https://karaf.apache.org/security/cve-2024-34365.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/09/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Karaf Cave: Cave SSRF and arbitrary file access "
}
GHSA-33C5-CHM5-2GGP
Vulnerability from github – Published: 2026-09-14 15:32 – Updated: 2026-09-14 15:32A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.
{
"affected": [],
"aliases": [
"CVE-2026-90790"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T15:17:13Z",
"severity": "MODERATE"
},
"details": "A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.",
"id": "GHSA-33c5-chm5-2ggp",
"modified": "2026-09-14T15:32:49Z",
"published": "2026-09-14T15:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90790"
},
{
"type": "WEB",
"url": "https://github.com/a2aproject/a2a-python/pull/1164"
},
{
"type": "WEB",
"url": "https://github.com/a2aproject/a2a-python/pull/1169"
},
{
"type": "WEB",
"url": "https://github.com/a2aproject/a2a-python"
},
{
"type": "WEB",
"url": "https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-90790"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/919747"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403296"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/403296/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-33CJ-W75F-49M2
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-02-12 11:17A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "magento/community-edition"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-7911"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-01T22:55:18Z",
"nvd_published_at": "2019-08-02T22:15:00Z",
"severity": "HIGH"
},
"details": "A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.",
"id": "GHSA-33cj-w75f-49m2",
"modified": "2024-02-12T11:17:22Z",
"published": "2022-05-24T16:52:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7911"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7911.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7911.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7911.yaml"
},
{
"type": "WEB",
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Magento 2 Community Edition Server-Side Request Forgery vulnerability"
}
GHSA-33HM-J2Q7-C3HP
Vulnerability from github – Published: 2026-10-21 03:32 – Updated: 2026-10-21 03:32SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.
{
"affected": [],
"aliases": [
"CVE-2026-114062"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-21T01:17:29Z",
"severity": "MODERATE"
},
"details": "SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.",
"id": "GHSA-33hm-j2q7-c3hp",
"modified": "2026-10-21T03:32:19Z",
"published": "2026-10-21T03:32:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sveltejs/kit/security/advisories/GHSA-prjg-x2qj-wj3g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114062"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-ssrf-via-redirects-in-server-side-self-fetch-fallbacks"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.