Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.9 Medium
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy
- Broken access control
- Server-side request forgery (SSRF)
<2026.4.10 · fixed in 2026.4.10
GHSA-rj2p-j66c-mgqh · CVE-2026-42439 - CVSS 6.3 Medium
OpenClaw: Browser SSRF policy default allowed private-network navigation
- Server-side request forgery (SSRF)
- CWE-1188
<2026.4.14 · fixed in 2026.4.14
GHSA-53vx-pmqw-863c · CVE-2026-43527 - CVSS 4.9 Medium
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding
- Race condition
- Server-side request forgery (SSRF)
<2026.4.10 · fixed in 2026.4.10
GHSA-xq94-r468-qwgj · CVE-2026-43582 - CVSS 8.3 High
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes
- Server-side request forgery (SSRF)
<2026.4.12 · fixed in 2026.4.12
GHSA-2767-2q9v-9326 · CVE-2026-43526 - CVSS 4.9 Medium
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation
- Broken access control
- Server-side request forgery (SSRF)
<2026.4.14 · fixed in 2026.4.14
GHSA-c4qm-58hj-j6pj · CVE-2026-42436 - CVSS 7.8 High
OpenHarness SSRF via web_fetch and web_search
- HKUDS OpenHarness
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Craftql vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=1.3.7 · no fixed version yet
GHSA-8wmw-prw8-2ggm · CVE-2026-31317 - CVSS 5.3 Medium
prasathmani TinyFileManager File Upload filemanager.php server-side request forgery
- prasathmani TinyFileManager
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-Side Request Forgery in GREENmod
- Nomios Poland GREENmod
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
- Server-side request forgery (SSRF)
>=1.14.0, <=1.21.4 · no fixed version yet
GHSA-8r5m-3f66-qpr3 · CVE-2026-5052 - CVSS 3.1 Low
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
- Server-side request forgery (SSRF)
<1.1.14 · fixed in 1.1.14
GHSA-r7w7-9xr2-qq2r · CVE-2026-41488 - CVSS 6.5 Medium
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
- Server-side request forgery (SSRF)
<1.1.2 · fixed in 1.1.2
GHSA-fv5p-p927-qmxr · CVE-2026-41481 - CVSS 8.7 High
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
- Server-side request forgery (SSRF)
<=18.2.14 || >=19.0.0-next.0, <19.2.21 || >=20.0.0-next.0, <20.3.19 || >=21.0.0-next.0, <21.2.9 || >=22.0.0-next.0, <22.0.0-next.8 · fixed in 19.2.21, 20.3.19, 21.2.9, 22.0.0-next.8
GHSA-45q2-gjvg-7973 · CVE-2026-41423 - CVSS 7.1 High
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-6r77-hqx7-7vw8 · CVE-2026-41271 - CVSS 7.1 High
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
- Race condition
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-2x8m-83vc-6wv4 · CVE-2026-41272 - CVSS 7.1 High
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
- Broken access control
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-xhmj-rg95-44hv · CVE-2026-41270 - CVSS 5.0 Medium
Istio: SSRF via RequestAuthentication jwksUri
- Server-side request forgery (SSRF)
<0.0.0-20260410004459-189832a289c1 · fixed in 0.0.0-20260410004459-189832a289c1
GHSA-fgw5-hp8f-xfhc · CVE-2026-41413 - CVSS 8.1 High
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
- Information disclosure
- Server-side request forgery (SSRF)
<1.17.0 · fixed in 1.17.0
GHSA-f9g8-6ppc-pqq4 · CVE-2026-41323 - CVSS 6.0 Medium
Flowise Execute Flow function has an SSRF vulnerability
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-9hrv-gvrv-6gf2 · CVE-2026-56275 - CVSS 5.3 Medium
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-qqvm-66q4-vf5c · CVE-2026-43995 - CVSS 4.1 Medium
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
- Server-side request forgery (SSRF)
<5.17 · fixed in 5.17
GHSA-f8hv-g549-hwg2 · CVE-2026-39845 - CVSS 5.0 Medium
Weblate: SSRF via Project-Level Machinery Configuration
- Information disclosure
- Server-side request forgery (SSRF)
<5.17 · fixed in 5.17
GHSA-xrwr-fcw6-fmq8 · CVE-2026-34244 - CVSS 5.0 Medium
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
- Server-side request forgery (SSRF)
<5.17 · fixed in 5.17
GHSA-5fhx-9jwj-867m · CVE-2026-33440 - CVSS 6.8 Medium
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
- Server-side request forgery (SSRF)
<=3.0.255 · no fixed version yet
GHSA-gmwr-9j4p-96vm · CVE-2026-40500 - CVSS 6.4 Medium
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
- Server-side request forgery (SSRF)
<2.0.37 · fixed in 2.0.37
GHSA-mvvv-v22x-xqwp · CVE-2026-40346 - CVSS 5.5 Medium
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.17.9 || >=5.0.0-RC1, <5.9.15 · fixed in 4.17.9, 5.9.15
GHSA-95wr-3f2v-v2wh · CVE-2026-41130 - CVSS 5.5 Medium
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.17.9 || >=5.0.0-RC1, <5.9.15 · fixed in 4.17.9, 5.9.15
GHSA-3m9m-24vh-39wx · CVE-2026-41129 - CVSS 8.3 High
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
- Server-side request forgery (SSRF)
<3.15.0 · fixed in 3.15.0
GHSA-4x48-cgf9-q33f · CVE-2026-125114 - CVSS 7.7 High
WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
- Server-side request forgery (SSRF)
<=29.0 · no fixed version yet
GHSA-j432-4w3j-3w8j · CVE-2026-41060 - CVSS 8.6 High
WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF
- Server-side request forgery (SSRF)
<=29.0 · no fixed version yet
GHSA-793q-xgj6-7frp · CVE-2026-41055 - CVSS 8.5 High
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
- Server-side request forgery (SSRF)
>=1.16.0, <1.17.0 · fixed in 1.17.0
GHSA-rggm-jjmc-3394 · CVE-2026-4789 - CVSS 8.6 High
Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner
- jellyfin
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services
- chamilo-lms
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action
- chamilo-lms
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach
- Server-side request forgery (SSRF)
<1.16.2 · fixed in 1.16.2
GHSA-fmqp-4wfc-w3v7 · CVE-2026-84199 - CVSS 8.3 High
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF
- Server-side request forgery (SSRF)
<=1.17.1 · no fixed version yet
GHSA-qr4g-8hrp-c4rw · CVE-2026-84196 - CVSS 8.5 High
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<=2.2.0 · no fixed version yet
GHSA-fpx9-9hq8-w2xc · CVE-2026-38527 - CVSS 4.1 Medium
Server-side request forgery in Fortinet FortiSOAR on-premise and others
- Fortinet FortiSOAR on-premise
- Fortinet FortiSOAR PaaS
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
MaxKB: SSRF via sandbox network hook bypass
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery
- HummerRisk
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
- espocrm
- Race condition
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery
- DbGate
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
- espocrm
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
- Server-side request forgery (SSRF)
<0.2.0 · fixed in 0.2.0
GHSA-c4hg-6933-x62x · CVE-2026-34476 - CVSS 8.5 High
Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API
- Foxit Software Inc. Foxit PDF Services API
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery
- AstrBot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MetaGPT affected by server-side request forgery in metagpt/utils/common.py
- Server-side request forgery (SSRF)
<=0.8.2 · no fixed version yet
GHSA-r5v8-c28h-f8r8 · CVE-2026-6111 - CVSS 5.0 Medium
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
- stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
- Server-side request forgery (SSRF)
<2.0.75 · fixed in 2.0.75
GHSA-55v6-g8pm-pw4c - CVSS 6.3 Medium
Duplicate Advisory: GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
- Server-side request forgery (SSRF)
>=4.0.0, <4.4.5 || >=5.0.0, <5.0.2 · fixed in 4.4.5, 5.0.2
GHSA-v8f7-cg9p-w5jx - CVSS 7.2 High
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
- Server-side request forgery (SSRF)
<1.17.3 · fixed in 1.17.3
GHSA-ff24-4prj-gpmj · CVE-2026-40242 - CVSS 5.3 Medium
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outb...
- Server-side request forgery (SSRF)
>=4.0.0, <4.4.5 || >=5.0.0, <5.0.2 · fixed in 4.4.5, 5.0.2
PYSEC-2026-2159 · CVE-2026-39921 - CVSS 5.1 Medium
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
- Server-side request forgery (SSRF)
<4.4.3 · fixed in 4.4.3
GHSA-r2x7-427f-rq69 · CVE-2026-79671 - CVSS 4.8 Medium
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
- Other injection
- HTTP request smuggling
<0.31.0 || >=1.0.0, <1.15.0 · fixed in 0.31.0, 1.15.0
GHSA-fvcv-3m26-pcqx · CVE-2026-40175 - CVSS 7.2 High
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
- Server-side request forgery (SSRF)
<4.5.128 · fixed in 4.5.128
GHSA-8frj-8q3m-xhgm · CVE-2026-40114 - CVSS 7.1 High
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
- Server-side request forgery (SSRF)
>=0.13.23, <1.5.128 · fixed in 1.5.128
GHSA-qq9r-63f6-v542 · CVE-2026-40160 - CVSS 7.7 High
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
- Server-side request forgery (SSRF)
<1.5.128 · fixed in 1.5.128
GHSA-8f4v-xfm9-3244 · CVE-2026-40150 - CVSS 8.7 High
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
- Server-side request forgery (SSRF)
<0.0.0-20260407035653-2f416e5253f1 · fixed in 0.0.0-20260407035653-2f416e5253f1
GHSA-w95v-4h65-j455 · CVE-2026-40107 - CVSS 8.2 High
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 7.8 High
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- chartbrew
- Server-side request forgery (SSRF)