GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-28677

Vulnerability from fkie_nvd - Published: 2026-03-06 05:16 - Updated: 2026-06-17 10:28
Severity
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Summary
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.
References
security-advisories@github.comhttps://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840bPatch
security-advisories@github.comhttps://github.com/OpenSift/OpenSift/commit/de99b9cPatch
security-advisories@github.comhttps://github.com/OpenSift/OpenSift/pull/67Issue Tracking, Patch
security-advisories@github.comhttps://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alphaRelease Notes
security-advisories@github.comhttps://github.com/OpenSift/OpenSift/security/advisories/GHSA-5jfc-p787-2mf9Patch, Vendor Advisory
Impacted products
Vendor Product Version
opensift opensift *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OpenSift",
          "vendor": "OpenSift",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.3-alpha"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensift:opensift:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "D1037E2F-1527-4C09-8D8D-78E56E6DDC78",
              "versionEndExcluding": "1.6.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha."
    },
    {
      "lang": "es",
      "value": "OpenSift es una herramienta de estudio de IA que filtra grandes conjuntos de datos utilizando b\u00fasqueda sem\u00e1ntica e IA generativa. Antes de la versi\u00f3n 1.6.3-alpha, el pipeline de ingesta de URL aceptaba URL remotas controladas por el usuario con restricciones de destino incompletas. Aunque exist\u00edan comprobaciones de host privado/local, la falta de restricciones para URL con credenciales, puertos no est\u00e1ndar y redirecciones entre hosts dejaban rutas de abuso de clase SSRF en despliegues que no eran localhost. Este problema ha sido parcheado en la versi\u00f3n 1.6.3-alpha."
    }
  ],
  "id": "CVE-2026-28677",
  "lastModified": "2026-06-17T10:28:52.877",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-28677",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-06T16:00:17.295863Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-06T05:16:36.610",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OpenSift/OpenSift/commit/de99b9c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/OpenSift/OpenSift/pull/67"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OpenSift/OpenSift/security/advisories/GHSA-5jfc-p787-2mf9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.