Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6598 vulnerabilities reference this CWE, most recent first.

GHSA-J85C-QQPV-57M3

Vulnerability from github – Published: 2026-09-22 21:31 – Updated: 2026-09-22 21:31
VLAI
Details

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776

Severity
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-96259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T21:17:34Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 11.9.x \u003c= 11.9.1, 11.8.x \u003c= 11.8.5, 11.7.x \u003c= 11.7.10, 11.10.x \u003c= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776",
  "id": "GHSA-j85c-qqpv-57m3",
  "modified": "2026-09-22T21:31:31Z",
  "published": "2026-09-22T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96259"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J8F7-X8JM-WMM4

Vulnerability from github – Published: 2026-10-06 13:39 – Updated: 2026-10-06 13:39
VLAI
Summary
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Details

Summary

Before Langflow 1.10.3, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example http://169.254.169.254/latest/meta-data/), and in many cases read the response back through the component output.

Two things combined to cause this:

  1. Protection disabled / warn-only. The SSRF guard (lfx/utils/ssrf_protection.py, added in 1.7.0 by #10544) shipped with ssrf_protection_enabled = False, and its only caller, the API Request component, called validate_url_for_ssrf(url, warn_only=True). So even with protection turned on, blocked URLs were only logged.
  2. Inconsistent coverage. Other components that take a user-supplied URL or base URL did not call the guard at all: RSS Reader, SearXNG, Web Search (fetching result / RSS URLs), Home Assistant, Glean Search and Docling Serve (remote).

The problem was fixed across several PRs and is fully fixed in Langflow 1.10.3 (and 1.11.0+). With the default settings, outbound requests from these components are now validated after DNS resolution, pinned to the validated IP (to prevent DNS rebinding) and blocked when they target private, loopback, link-local or metadata addresses, unless the operator allowlists the host.

Affected versions

Package (PyPI) Vulnerable Patched
langflow < 1.10.3 1.10.3
langflow-base < 0.10.3 0.10.3
lfx < 1.10.3 1.10.3
lfx-docling (Docling Serve component) < 0.1.2 0.1.2

How the fix rolled out:

Release Change
< 1.7.0 No SSRF guard. All URL-taking components make unrestricted requests.
1.7.0 – 1.9.2 Guard exists, but ssrf_protection_enabled=False by default and API Request uses warn_only=True.
1.9.3 #13016: protection on by default, API Request blocks (DNS pinning / anti-rebinding). Other components still unprotected.
1.10.1 #13395 (RSS Reader, SearXNG) and #13643 (Home Assistant, Glean, plus model-provider URL components) route requests through SSRF-safe helpers.
1.10.3 #14033 (Docling Serve) and #14071 (Web Search result/RSS fetching). All components cited in this report are protected.

Details

Vulnerable pattern (for example rss.py before #13395):

response = requests.get(self.rss_url, timeout=self.timeout)

API Request before #13016:

# TODO: In next major version (2.0), remove warn_only=True to enforce blocking
validate_url_for_ssrf(url, warn_only=True)

with ssrf_protection_enabled: bool = False in the settings.

Clarifications on the original report. Some sinks in the report are not exploitable SSRF:

  • web_search.py: the DuckDuckGo search request and the Google News RSS request, and news_search.py:131. The host is hard-coded (html.duckduckgo.com / news.google.com) and user input only goes into quote_plus-encoded path and query segments, so the destination cannot be redirected. The real Web Search sink was fetching the result URLs, which is fixed in #14071.
  • langflow/load/utils.py get_flow(): this is a client-side SDK helper (from langflow.load import get_flow) that the caller runs against their own Langflow URL. No API route calls it, so it is not a backend SSRF endpoint.

PoC (vulnerable versions)

  1. Log in as any user who can create flows.
  2. Add an RSS Reader (or SearXNG / Home Assistant / Glean / Docling Serve) component and set its URL to http://169.254.169.254/latest/meta-data/ (or an internal host such as http://10.0.0.1/).
  3. Run the component. The Langflow server issues the request, and the response or error is shown in the component output.

On patched versions the same run fails with SSRFProtectionError: Access to IP address 169.254.169.254 is blocked by SSRF protection.

Impact

  • Access to cloud instance metadata (IAM credentials / tokens) on AWS, GCP and Azure deployments.
  • Probing and interaction with internal services and private networks reachable from the Langflow host.
  • Requires an authenticated account with permission to build or run flows. Deployments where every user is already fully trusted are less affected.

Fix

  • #13016: sets ssrf_protection_enabled = True by default, changes warn_only to default False, drops warn_only=True from API Request, and adds validate_and_resolve_url() plus SSRFProtectedTransport (DNS pinning).

diff - ssrf_protection_enabled: bool = False + ssrf_protection_enabled: bool = True - #13395: adds lfx.utils.ssrf_requests.ssrf_safe_get (per-hop validation and pinning for requests) and uses it in RSS Reader and SearXNG.

diff - response = requests.get(self.rss_url, timeout=self.timeout) + response = ssrf_safe_get(self.rss_url, timeout=self.timeout) - #13643: adds lfx.utils.ssrf_httpx (ssrf_safe_httpx_get/post, protected client kwargs) and applies it to Home Assistant, Glean and the model-provider base-URL components. - #14033: Docling Serve builds its httpx.Client with ssrf_protected_httpx_client_kwargs_for_url(base_url). - #14071 (release-1.10.3) / #14073 (forward-port to 1.11.0): Web Search validates and pins each result URL before fetching it, with redirects disabled.

Note: connector-style components (for example Home Assistant, Ollama, LM Studio) keep a documented loopback exemption (#14146), so a self-hosted user can reach a local service on localhost. Private-network and metadata addresses stay blocked. Operators can tighten or relax this with LANGFLOW_SSRF_ALLOWED_HOSTS and LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED.

Remediation

  • Upgrade to langflow >= 1.10.3 (or langflow-base >= 0.10.3 / lfx >= 1.10.3 / lfx-docling >= 0.1.2).
  • Do not set LANGFLOW_SSRF_PROTECTION_ENABLED=false. If you need to reach internal hosts on purpose, allowlist only those hosts with LANGFLOW_SSRF_ALLOWED_HOSTS.
  • On versions that cannot be upgraded right away, restrict outbound network access from the Langflow host (for example, block 169.254.169.254 and use IMDSv2 on AWS).
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow-base"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lfx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lfx-docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T13:39:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nBefore **Langflow 1.10.3**, several built-in components sent server-side HTTP requests to URLs the flow author controls, with no SSRF enforcement. An authenticated user who can build or run flows could make the Langflow server reach loopback, RFC 1918 / private networks, link-local addresses and cloud metadata endpoints (for example `http://169.254.169.254/latest/meta-data/`), and in many cases read the response back through the component output.\n\nTwo things combined to cause this:\n\n1. **Protection disabled / warn-only.** The SSRF guard (`lfx/utils/ssrf_protection.py`, added in 1.7.0 by #10544) shipped with `ssrf_protection_enabled = False`, and its only caller, the **API Request** component, called `validate_url_for_ssrf(url, warn_only=True)`. So even with protection turned on, blocked URLs were only logged.\n2. **Inconsistent coverage.** Other components that take a user-supplied URL or base URL did not call the guard at all: RSS Reader, SearXNG, Web Search (fetching result / RSS URLs), Home Assistant, Glean Search and Docling Serve (remote).\n\nThe problem was fixed across several PRs and is fully fixed in **Langflow 1.10.3** (and 1.11.0+). With the default settings, outbound requests from these components are now validated after DNS resolution, pinned to the validated IP (to prevent DNS rebinding) and **blocked** when they target private, loopback, link-local or metadata addresses, unless the operator allowlists the host.\n\n### Affected versions\n\n| Package (PyPI) | Vulnerable | Patched |\n|---|---|---|\n| `langflow` | `\u003c 1.10.3` | `1.10.3` |\n| `langflow-base` | `\u003c 0.10.3` | `0.10.3` |\n| `lfx` | `\u003c 1.10.3` | `1.10.3` |\n| `lfx-docling` (Docling Serve component) | `\u003c 0.1.2` | `0.1.2` |\n\nHow the fix rolled out:\n\n| Release | Change |\n|---|---|\n| `\u003c 1.7.0` | No SSRF guard. All URL-taking components make unrestricted requests. |\n| `1.7.0` \u2013 `1.9.2` | Guard exists, but `ssrf_protection_enabled=False` by default and API Request uses `warn_only=True`. |\n| `1.9.3` | #13016: protection **on by default**, API Request **blocks** (DNS pinning / anti-rebinding). Other components still unprotected. |\n| `1.10.1` | #13395 (RSS Reader, SearXNG) and #13643 (Home Assistant, Glean, plus model-provider URL components) route requests through SSRF-safe helpers. |\n| `1.10.3` | #14033 (Docling Serve) and #14071 (Web Search result/RSS fetching). **All components cited in this report are protected.** |\n\n### Details\n\nVulnerable pattern (for example `rss.py` before #13395):\n\n```python\nresponse = requests.get(self.rss_url, timeout=self.timeout)\n```\n\nAPI Request before #13016:\n\n```python\n# TODO: In next major version (2.0), remove warn_only=True to enforce blocking\nvalidate_url_for_ssrf(url, warn_only=True)\n```\n\nwith `ssrf_protection_enabled: bool = False` in the settings.\n\n**Clarifications on the original report.** Some sinks in the report are not exploitable SSRF:\n\n- `web_search.py`: the DuckDuckGo search request and the Google News RSS request, and `news_search.py:131`. The host is hard-coded (`html.duckduckgo.com` / `news.google.com`) and user input only goes into `quote_plus`-encoded path and query segments, so the destination cannot be redirected. The real Web Search sink was fetching the **result URLs**, which is fixed in #14071.\n- `langflow/load/utils.py` `get_flow()`: this is a client-side SDK helper (`from langflow.load import get_flow`) that the caller runs against their own Langflow URL. No API route calls it, so it is not a backend SSRF endpoint.\n\n### PoC (vulnerable versions)\n\n1. Log in as any user who can create flows.\n2. Add an **RSS Reader** (or SearXNG / Home Assistant / Glean / Docling Serve) component and set its URL to `http://169.254.169.254/latest/meta-data/` (or an internal host such as `http://10.0.0.1/`).\n3. Run the component. The Langflow server issues the request, and the response or error is shown in the component output.\n\nOn patched versions the same run fails with `SSRFProtectionError: Access to IP address 169.254.169.254 is blocked by SSRF protection`.\n\n### Impact\n\n- Access to cloud instance metadata (IAM credentials / tokens) on AWS, GCP and Azure deployments.\n- Probing and interaction with internal services and private networks reachable from the Langflow host.\n- Requires an authenticated account with permission to build or run flows. Deployments where every user is already fully trusted are less affected.\n\n### Fix\n\n- **#13016**: sets `ssrf_protection_enabled = True` by default, changes `warn_only` to default `False`, drops `warn_only=True` from API Request, and adds `validate_and_resolve_url()` plus `SSRFProtectedTransport` (DNS pinning).\n\n  ```diff\n  -    ssrf_protection_enabled: bool = False\n  +    ssrf_protection_enabled: bool = True\n  ```\n- **#13395**: adds `lfx.utils.ssrf_requests.ssrf_safe_get` (per-hop validation and pinning for `requests`) and uses it in RSS Reader and SearXNG.\n\n  ```diff\n  -            response = requests.get(self.rss_url, timeout=self.timeout)\n  +            response = ssrf_safe_get(self.rss_url, timeout=self.timeout)\n  ```\n- **#13643**: adds `lfx.utils.ssrf_httpx` (`ssrf_safe_httpx_get/post`, protected client kwargs) and applies it to Home Assistant, Glean and the model-provider base-URL components.\n- **#14033**: Docling Serve builds its `httpx.Client` with `ssrf_protected_httpx_client_kwargs_for_url(base_url)`.\n- **#14071** (release-1.10.3) / **#14073** (forward-port to 1.11.0): Web Search validates and pins each result URL before fetching it, with redirects disabled.\n\nNote: connector-style components (for example Home Assistant, Ollama, LM Studio) keep a documented loopback exemption (#14146), so a self-hosted user can reach a local service on `localhost`. Private-network and metadata addresses stay blocked. Operators can tighten or relax this with `LANGFLOW_SSRF_ALLOWED_HOSTS` and `LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED`.\n\n### Remediation\n\n- Upgrade to `langflow \u003e= 1.10.3` (or `langflow-base \u003e= 0.10.3` / `lfx \u003e= 1.10.3` / `lfx-docling \u003e= 0.1.2`).\n- Do not set `LANGFLOW_SSRF_PROTECTION_ENABLED=false`. If you need to reach internal hosts on purpose, allowlist only those hosts with `LANGFLOW_SSRF_ALLOWED_HOSTS`.\n- On versions that cannot be upgraded right away, restrict outbound network access from the Langflow host (for example, block `169.254.169.254` and use IMDSv2 on AWS).",
  "id": "GHSA-j8f7-x8jm-wmm4",
  "modified": "2026-10-06T13:39:58Z",
  "published": "2026-10-06T13:39:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-j8f7-x8jm-wmm4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/13016"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/13395"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/13643"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/14033"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/14071"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)"
}

GHSA-J8JW-W4G4-Q965

Vulnerability from github – Published: 2024-03-01 09:31 – Updated: 2026-04-01 18:31
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in sirv.Com Image Optimizer, Resizer and CDN – Sirv.This issue affects Image Optimizer, Resizer and CDN – Sirv: from n/a through 7.2.0.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-27949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-01T08:15:38Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in sirv.Com Image Optimizer, Resizer and CDN \u2013 Sirv.This issue affects Image Optimizer, Resizer and CDN \u2013 Sirv: from n/a through 7.2.0.",
  "id": "GHSA-j8jw-w4g4-q965",
  "modified": "2026-04-01T18:31:42Z",
  "published": "2024-03-01T09:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27949"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/sirv/vulnerability/wordpress-sirv-plugin-7-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/sirv/wordpress-sirv-plugin-7-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J8W6-2R9H-CXHJ

Vulnerability from github – Published: 2023-12-15 04:02 – Updated: 2024-11-22 18:15
VLAI
Summary
GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182
Details

Impact

Issue: Arbitrary file write in file.py (GHSL-2023-183)

Patches

Use mindsdb staging branch or v23.11.4.1

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 23.7.4.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "mindsdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "23.11.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-50731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-15T04:02:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nIssue: Arbitrary file write in file.py (GHSL-2023-183)\n\n### Patches\n\nUse mindsdb staging branch or v23.11.4.1",
  "id": "GHSA-j8w6-2r9h-cxhj",
  "modified": "2024-11-22T18:15:01Z",
  "published": "2023-12-15T04:02:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50731"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mindsdb/mindsdb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-279.yaml"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182 "
}

GHSA-J943-8RCJ-JVF4

Vulnerability from github – Published: 2026-08-19 06:31 – Updated: 2026-08-19 21:30
VLAI
Details

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-17565"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T06:17:36Z",
    "severity": "HIGH"
  },
  "details": "The Animation Addons for Elementor  WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.",
  "id": "GHSA-j943-8rcj-jvf4",
  "modified": "2026-08-19T21:30:28Z",
  "published": "2026-08-19T06:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17565"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/e88e0b71-145c-4edd-9b62-783215b64c67"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J94R-GH6R-5XFH

Vulnerability from github – Published: 2024-04-02 21:30 – Updated: 2026-04-28 21:34
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-30532"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-02T19:15:47Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.",
  "id": "GHSA-j94r-gh6r-5xfh",
  "modified": "2026-04-28T21:34:31Z",
  "published": "2024-04-02T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30532"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/builderall-cheetah-for-wp/wordpress-builderall-builder-for-wordpress-plugin-2-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J94X-8WCP-X7HM

Vulnerability from github – Published: 2026-03-16 20:47 – Updated: 2026-03-20 21:18
VLAI
Summary
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Details

Summary

Kargo's built-in http and http-download promotion steps execute outbound HTTP requests from the Kargo controller. By design, these steps do not restrict destination addresses, as there are legitimate use cases for requests to internal and private endpoints. However, this also permits requests to link-local addresses, for which there are no known, legitimate use cases. Of particular concern is the cloud instance metadata endpoint (often 169.254.169.254), which is unauthenticated and can expose sensitive configuration data including IAM credentials. While cloud providers typically implement header-based SSRF mitigations for these endpoints, the http step provides full control over request method and headers, rendering these protections ineffective. The http-download step provides control over headers only (not method), but this is still sufficient for exfiltrating data from metadata endpoints.

There are two vectors for exploitation. A user with permission to create or update a Stage can configure its promotion template to include malicious http or http-download steps. Alternatively, a user with promote permission on any Stage can craft a Promotion resource directly. In either case, the controller executes the steps in-cluster, and response data can be inserted into Promotion status fields, written to a Git repository, or sent to a remote location using a second instance of the http step.

The remediation for this issue is the introduction of a safe HTTP transport that refuses to dial link-local addresses. Requests to private and internal addresses will continue to be permitted, as this is by design. It is the responsibility of services at such addresses to implement proper authentication and authorization, and/or the responsibility of platform teams to define and enforce network policies that restrict traffic appropriately.

Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics.

Attack Vector (AV): Network

The Kargo API server is accessible over HTTP/HTTPS. No local, adjacent network, or physical access is required.

Attack Complexity (AC): Low

Exploitation requires only a crafted Promotion manifest submitted via the Kargo API. No race conditions, non-default configurations, or prior information gathering is required.

Attack Requirements (AT): None

No specific environmental conditions are required beyond a standard Kargo deployment. The http and http-download built-in steps are always available.

Privileges Required (PR): High

The attacker must be authenticated to the Kargo API server and hold permissions sufficient to create or update a Stage, or to craft a Promotion resource directly. Although these may not be considered administrative permissions, they are non-trivial, not granted broadly by default, and must be explicitly assigned by a project administrator.

User Interaction (UI): None

The attack is fully automated via API calls. No other user needs to take any action. The controller processes the malicious Promotion without human intervention.

Confidentiality Impact to Vulnerable System (VC): None

Kargo itself does not expose its own secrets or configuration data through this vulnerability. The impact is to other systems reachable from the controller's network position, not to Kargo's own data.

Integrity Impact to Vulnerable System (VI): None

Kargo's own data and configuration are not modified by this vulnerability. While malicious Promotion resources are created, they function within Kargo's normal processing pipeline.

Availability Impact to Vulnerable System (VA): None

This vulnerability does not enable denial of service against Kargo. Each Promotion executes a bounded set of HTTP requests and does not consume disproportionate resources.

Confidentiality Impact to Subsequent Systems (SC): Low

The controller runs in-cluster and can reach link-local addresses, including cloud instance metadata endpoints. These endpoints are unauthenticated and can expose sensitive data such as IAM credentials. Provider-side header-based SSRF mitigations are ineffective because these steps provide full control over request headers.

Integrity Impact to Subsequent Systems (SI): None

Cloud instance metadata endpoints are read-only. While the http step supports arbitrary HTTP methods, the only unintended access enabled by this vulnerability is to link-local addresses, and these do not accept state-changing requests.

Availability Impact to Subsequent Systems (SA): None

A single HTTP request per promotion step does not constitute a meaningful denial-of-service vector against subsequent systems. There is no amplification mechanism.

Mitigating Factors

  • Exploitation requires authentication to the Kargo API server with permissions to create or update Stages, or to craft Promotion resources directly. These permissions must be explicitly granted by a project administrator.

  • All Promotion creation is audited. The creating user's identity is recorded in annotations and Kubernetes events, providing a clear forensic trail.

  • The practical impact is limited to cloud instance metadata endpoints. Access to private and internal addresses is by design, and services at those addresses are expected to implement their own authentication and authorization.

Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0-rc.1"
            },
            {
              "fixed": "1.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0-rc.1"
            },
            {
              "fixed": "1.8.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/akuity/kargo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0-rc.1"
            },
            {
              "fixed": "1.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32828"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T20:47:47Z",
    "nvd_published_at": "2026-03-20T01:15:56Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nKargo\u0027s built-in `http` and `http-download` promotion steps execute outbound HTTP requests from the Kargo controller. By design, these steps do not restrict destination addresses, as there are legitimate use cases for requests to internal and private endpoints. However, this also permits requests to link-local addresses, for which there are no known, legitimate use cases. Of particular concern is the cloud instance metadata endpoint (often `169.254.169.254`), which is unauthenticated and can expose sensitive configuration data including IAM credentials. While cloud providers typically implement header-based SSRF mitigations for these endpoints, the `http` step provides full control over request method and headers, rendering these protections ineffective. The `http-download` step provides control over headers only (not method), but this is still sufficient for exfiltrating data from metadata endpoints.\n\nThere are two vectors for exploitation. A user with permission to create or update a Stage can configure its promotion template to include malicious `http` or `http-download` steps. Alternatively, a user with `promote` permission on any Stage can craft a Promotion resource directly. In either case, the controller executes the steps in-cluster, and response data can be inserted into Promotion status fields, written to a Git repository, or sent to a remote location using a second instance of the `http` step.\n\nThe remediation for this issue is the introduction of a safe HTTP transport that refuses to dial link-local addresses. Requests to private and internal addresses will continue to be permitted, as this is by design. It is the responsibility of services at such addresses to implement proper authentication and authorization, and/or the responsibility of platform teams to define and enforce network policies that restrict traffic appropriately.\n\n### Base Metrics\n ---\nThe following sections provide the rationale for the values selected for each of CVSS v4\u0027s base metrics.\n\n### Attack Vector (AV): Network\nThe Kargo API server is accessible over HTTP/HTTPS. No local, adjacent network, or physical access is required.\n\n### Attack Complexity (AC): Low\nExploitation requires only a crafted Promotion manifest submitted via the Kargo API. No race conditions, non-default configurations, or prior information gathering is required.\n\n### Attack Requirements (AT): None\nNo specific environmental conditions are required beyond a standard Kargo deployment. The http and http-download built-in steps are always available.\n\n### Privileges Required (PR): High\nThe attacker must be authenticated to the Kargo API server and hold permissions sufficient to create or update a Stage, or to craft a Promotion resource directly. Although these may not be considered administrative permissions, they are non-trivial, not granted broadly by default, and must be explicitly assigned by a project administrator.\n\n### User Interaction (UI): None\nThe attack is fully automated via API calls. No other user needs to take any action. The controller processes the malicious Promotion without human intervention.\n\n### Confidentiality Impact to Vulnerable System (VC): None\nKargo itself does not expose its own secrets or configuration data through this vulnerability. The impact is to other systems reachable from the controller\u0027s network position, not to Kargo\u0027s own data.\n\n### Integrity Impact to Vulnerable System (VI): None\nKargo\u0027s own data and configuration are not modified by this vulnerability. While malicious Promotion resources are created, they function within Kargo\u0027s normal processing pipeline.\n\n### Availability Impact to Vulnerable System (VA): None\nThis vulnerability does not enable denial of service against Kargo. Each Promotion executes a bounded set of HTTP requests and does not consume disproportionate resources.\n\n### Confidentiality Impact to Subsequent Systems (SC): Low\nThe controller runs in-cluster and can reach link-local addresses, including cloud instance metadata endpoints. These endpoints are unauthenticated and can expose sensitive data such as IAM credentials. Provider-side header-based SSRF mitigations are ineffective because these steps provide full control over request headers.\n\n### Integrity Impact to Subsequent Systems (SI): None\nCloud instance metadata endpoints are read-only. While the http step supports arbitrary HTTP methods, the only unintended access enabled by this vulnerability is to link-local addresses, and these do not accept state-changing requests.\n\n### Availability Impact to Subsequent Systems (SA): None\nA single HTTP request per promotion step does not constitute a meaningful denial-of-service vector against subsequent systems. There is no amplification mechanism.\n\n## Mitigating Factors\n\n- Exploitation requires authentication to the Kargo API server with permissions to create or update Stages, or to craft Promotion resources directly. These permissions must be explicitly granted by a project administrator.\n\n- All Promotion creation is audited. The creating user\u0027s identity is recorded in annotations and Kubernetes events, providing a clear forensic trail.\n\n- The practical impact is limited to cloud instance metadata endpoints. Access to private and internal addresses is by design, and services at those addresses are expected to implement their own authentication and authorization.",
  "id": "GHSA-j94x-8wcp-x7hm",
  "modified": "2026-03-20T21:18:44Z",
  "published": "2026-03-16T20:47:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/security/advisories/GHSA-j94x-8wcp-x7hm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32828"
    },
    {
      "type": "WEB",
      "url": "https://github.com/akuity/kargo/commit/fd25620c2473ed19bec4be4d0f181287ef0f0391"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/akuity/kargo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration"
}

GHSA-J95R-86HX-XWXG

Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-16 13:42
VLAI
Summary
Rank Math SEO plugin vulnerable to Server-Side Request Forgery
Details

Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "rankmath/seo-by-rank-math"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.95"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T13:42:41Z",
    "nvd_published_at": "2022-09-09T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin \u003c= 1.0.95 at WordPress.",
  "id": "GHSA-j95r-86hx-xwxg",
  "modified": "2022-09-16T13:42:41Z",
  "published": "2022-09-10T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36376"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rankmath/seo-by-rank-math"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://rankmath.com/changelog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rank Math SEO plugin vulnerable to Server-Side Request Forgery"
}

GHSA-J95R-RM3W-F776

Vulnerability from github – Published: 2025-01-24 15:30 – Updated: 2025-01-24 15:30
VLAI
Details

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-11913"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-24T14:15:31Z",
    "severity": "MODERATE"
  },
  "details": "The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the \u0027ajax_preview_link\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-j95r-rm3w-f776",
  "modified": "2025-01-24T15:30:47Z",
  "published": "2025-01-24T15:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11913"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/bp-activity-plus-reloaded/tags/1.1.2/src/handlers/class-bpapr-preview-handler.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/69485409-8e91-4651-b9b8-69beb2364fa8?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-J95X-GPG4-Q4W9

Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-04-22 18:31
VLAI
Details

An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-35548"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T15:16:16Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials.",
  "id": "GHSA-j95x-gpg4-q4w9",
  "modified": "2026-04-22T18:31:44Z",
  "published": "2026-04-22T15:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35548"
    },
    {
      "type": "WEB",
      "url": "https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"
    },
    {
      "type": "WEB",
      "url": "https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list