Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.7 High
Server-Side Request Forgery (SSRF) in Chamilo LMS
- chamilo-lms
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default
- labring FastGPT
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
- Server-side request forgery (SSRF)
<2026.1.29 · fixed in 2026.1.29
GHSA-52vj-fvrv-7q82 · CVE-2026-6011 - CVSS 7.4 High
Duplicate Advisory: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
- Server-side request forgery (SSRF)
<2026.3.28 · fixed in 2026.3.28
GHSA-8j7f-g9gv-7jhc - CVSS 9.9 CriticalCritical · CVSS 9+
Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client
- sonicverse-eu audiostreaming-stack
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable
- Server-side request forgery (SSRF)
<2026.4.8 · fixed in 2026.4.8
GHSA-w8g9-x8gx-crmm · CVE-2026-42430 - CVSS 4.8 Medium
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation
- Server-side request forgery (SSRF)
<2026.4.8 · fixed in 2026.4.8
GHSA-vr5g-mmx7-h897 · CVE-2026-41912 - CVSS 5.1 Medium
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths
- Server-side request forgery (SSRF)
<2026.4.8 · fixed in 2026.4.8
GHSA-3fv3-6p2v-gxwj · CVE-2026-41914 - CVSS 6.3 Medium
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
- Server-side request forgery (SSRF)
- CWE-441
<0.31.0 || >=1.0.0, <1.15.0 · fixed in 0.31.0, 1.15.0
GHSA-3p68-rc4w-qgx5 · CVE-2025-62718 - CVSS 7.7 High
Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching
- plane
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
api-lab-mcp vulnerable to SSRF
- Server-side request forgery (SSRF)
<=0.2.1 · no fixed version yet
GHSA-crh9-3gjh-m6gc · CVE-2026-5832 - CVSS 9.1 CriticalCritical · CVSS 9+
Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery
- bigsk1 openai-realtime-ui
- Server-side request forgery (SSRF)
- CVSS 8.5 High
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
- Server-side request forgery (SSRF)
<2.47.4 · fixed in 2.47.4
GHSA-4ggg-h7ph-26qr · CVE-2026-39974 - CVSS 5.3 Medium
InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs
- InvenTree
- Server-side request forgery (SSRF)
- CVSS 7.5 High
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
- Server-side request forgery (SSRF)
<1.0.4 · fixed in 1.0.4
GHSA-v6ph-xcq9-qxxj · CVE-2026-39885 - CVSS 8.3 High
Zammad has a Server-side request forgery (SSRF) via webhooks
- zammad
- Server-side request forgery (SSRF)
- CVSS 5.2 Medium
Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure
- Elastic Kibana
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Mirror-registry: quay: quay: server-side request forgery via log export functionality
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability
- Podigee
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability
- Brecht Visual Link Preview
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability
- Global Payments GlobalPayments WooCommerce
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability
- Getty Images
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability
- Nelio Software Nelio Content
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerability
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Verify Identity Access Container
- IBM Security Verify Access Container
- Server-side request forgery (SSRF)
- CVSS 7.1 High
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-cmcr-q4jf-p6q9 · CVE-2026-39370 - CVSS 6.5 Medium
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-q4x6-6mm2-crg9 · CVE-2026-39368 - CVSS 9.1 CriticalCritical · CVSS 9+
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized befor…
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
QD 20230821 is vulnerable to Server-side request forgery (SSRF) via a crafted request
- Server-side request forgery (SSRF)
- CVSS 7.7 High
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
- openobserve
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection
- Server-side request forgery (SSRF)
<2026.3.31 · fixed in 2026.3.31
GHSA-vjx8-8p7h-82gr · CVE-2026-41297 - CVSS 7.0 High
SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts
- CRM
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 7.5 High
text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation
- oobabooga text-generation-webui
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL
- papra
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
- Server-side request forgery (SSRF)
<=2.8.3 · no fixed version yet
GHSA-3p65-76g6-3w7r · CVE-2026-33540 - CVSS 5.8 Medium
whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3
- pavelzbornik whisperX-FastAPI
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
assafelovic gpt-researcher ws Endpoint server-side request forgery
- assafelovic gpt-researcher
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
- hcengineering Huly Platform
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
kalcaddle kodbox shareMake/shareCheck server-side request forgery
- kalcaddle kodbox
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery
- imprvhub mcp-browser-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery
- QingdaoU OnlineJudge
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Ollama Model Pull API download.go server-side request forgery
- Ollama
- Server-side request forgery (SSRF)
- CVSS 1.7 Low
web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling
- Server-side request forgery (SSRF)
>=6.0.0b3, <7.15.0 || >=8.0.0b1, <8.0.0b2 · fixed in 7.15.0, 8.0.0b2
GHSA-5hr4-253g-cpx2 · CVE-2026-111171 - CVSS 7.7 High
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import
- Server-side request forgery (SSRF)
- CWE-20
<11.16.0 · fixed in 11.16.0
GHSA-wv3h-5fx7-966h · CVE-2026-35409 - CVSS 7.7 High
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
- Server-side request forgery (SSRF)
<=0.5.0b3.dev96 · no fixed version yet
GHSA-2wvg-62qm-gj33 · CVE-2026-35187 - CVSS 5.4 Medium
vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
- Server-side request forgery (SSRF)
>=0.16.0, <0.19.0 · fixed in 0.19.0
GHSA-pf3h-qjgv-vcpr · CVE-2026-34753 - CVSS 8.6 High
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)
- Server-side request forgery (SSRF)
<0.15.0 · fixed in 0.15.0
GHSA-qw2m-4pqf-rmpp · CVE-2026-33752 - CVSS 9.6 CriticalCritical · CVSS 9+
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- Server-side request forgery (SSRF)
- CWE-1188
<3.33.4 · fixed in 3.33.4
GHSA-7r9j-r86q-7g45 · CVE-2026-31818 - CVSS 7.1 High
prompts.chat SSRF via Fal.ai Media Status Polling
- f prompts.chat
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
prompts.chat Blind SSRF via media-generate
- f prompts.chat
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
- IceWhaleTech ZimaOS
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Bing Elevation of Privilege Vulnerability
- Microsoft Bing
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Casdoor vulnerable to SSRF via crafted Webhook URL
- Server-side request forgery (SSRF)
<=1.1000.0 · no fixed version yet
GHSA-p8c7-hjc4-gwf8 · CVE-2026-5469 - CVSS 5.3 Medium
mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
- mixelpixx Google-Research-MCP
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
- Server-side request forgery (SSRF)
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-vxg2-hhgr-37fx · CVE-2026-35540 - CVSS 7.2 High
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata
- Server-side request forgery (SSRF)
<1.4.8-0.20260401031029-4ca56fea5ba4 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
GHSA-cqgf-f4x7-g6wc · CVE-2026-35037