CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5856 vulnerabilities reference this CWE, most recent first.
GHSA-22QJ-F25C-22MC
Vulnerability from github – Published: 2025-02-12 18:31 – Updated: 2025-02-12 18:31An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
{
"affected": [],
"aliases": [
"CVE-2024-9870"
],
"database_specific": {
"cwe_ids": [
"CWE-441",
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T16:15:42Z",
"severity": "MODERATE"
},
"details": "An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.",
"id": "GHSA-22qj-f25c-22mc",
"modified": "2025-02-12T18:31:35Z",
"published": "2025-02-12T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9870"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2734142"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/498911"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-22RM-WP4X-V5CX
Vulnerability from github – Published: 2026-03-26 09:30 – Updated: 2026-07-15 20:11A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the client_session_host parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "26.5.0"
},
{
"fixed": "26.6.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4874"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T20:03:17Z",
"nvd_published_at": "2026-03-26T08:16:22Z",
"severity": "LOW"
},
"details": "A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server\u2019s network context, potentially probing internal networks or internal APIs, leading to information disclosure.",
"id": "GHSA-22rm-wp4x-v5cx",
"modified": "2026-07-15T20:11:33Z",
"published": "2026-03-26T09:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4874"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/47935"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/49682"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/49685"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/00dd0dd716c4319d3bac3eb2f2ac22d2a94f79fd"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/63de0efd351a7a684212a042a12271908f63f0ee"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25097"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25098"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30050"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4874"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451611"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation"
}
GHSA-22V2-WJ2V-MMRW
Vulnerability from github – Published: 2026-02-11 00:30 – Updated: 2026-02-11 00:30DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.
{
"affected": [],
"aliases": [
"CVE-2026-25870"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T23:16:16Z",
"severity": "MODERATE"
},
"details": "DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.",
"id": "GHSA-22v2-wj2v-mmrw",
"modified": "2026-02-11T00:30:19Z",
"published": "2026-02-11T00:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25870"
},
{
"type": "WEB",
"url": "https://github.com/doramart/DoraCMS/issues/268"
},
{
"type": "WEB",
"url": "https://www.doracms.net"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/doracms-ueditor-remote-image-fetch-ssrf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2356-GXG8-HHW3
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-14 00:01Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
{
"affected": [],
"aliases": [
"CVE-2022-29942"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T18:15:00Z",
"severity": "MODERATE"
},
"details": "Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry \u0027Add\u0027 functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.",
"id": "GHSA-2356-gxg8-hhw3",
"modified": "2022-05-14T00:01:30Z",
"published": "2022-05-05T00:00:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29942"
},
{
"type": "WEB",
"url": "https://Talend.com"
},
{
"type": "WEB",
"url": "https://www.talend.com/security/incident-response/#CVE-2022-29942"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-237M-VV9J-66Q2
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.
{
"affected": [],
"aliases": [
"CVE-2021-39867"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-05T13:15:00Z",
"severity": "HIGH"
},
"details": "In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF) attacks.",
"id": "GHSA-237m-vv9j-66q2",
"modified": "2022-05-24T19:16:35Z",
"published": "2022-05-24T19:16:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39867"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39867.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/214401"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-23QX-5WCH-W72W
Vulnerability from github – Published: 2026-08-27 18:32 – Updated: 2026-08-27 18:32The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
{
"affected": [],
"aliases": [
"CVE-2026-81091"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T17:20:51Z",
"severity": "HIGH"
},
"details": "The proxy middleware in mcp-use\u0027s inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.",
"id": "GHSA-23qx-5wch-w72w",
"modified": "2026-08-27T18:32:25Z",
"published": "2026-08-27T18:32:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81091"
},
{
"type": "WEB",
"url": "https://github.com/mcp-use/mcp-use"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/mcp-use-inspector-proxy-server-side-request-forgery-via-caller-supplied-target-url"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-23R8-P7QP-RWCQ
Vulnerability from github – Published: 2022-05-14 00:01 – Updated: 2026-07-05 00:31A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.
{
"affected": [],
"aliases": [
"CVE-2020-22983"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-13T13:15:00Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) vulnerability exists in MicroStrategy Web SDK 11.1 and earlier, allows remote unauthenticated attackers to conduct a server-side request forgery (SSRF) attack via the srcURL parameter to the shortURL task.",
"id": "GHSA-23r8-p7qp-rwcq",
"modified": "2026-07-05T00:31:31Z",
"published": "2022-05-14T00:01:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22983"
},
{
"type": "WEB",
"url": "https://medium.com/%40win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204"
},
{
"type": "WEB",
"url": "https://medium.com/@win3zz/how-i-made-31500-by-submitting-a-bug-to-facebook-d31bb046e204"
},
{
"type": "WEB",
"url": "https://tinyurl.com"
},
{
"type": "WEB",
"url": "https://www.microstrategy.com/us/report-a-security-vulnerability"
},
{
"type": "WEB",
"url": "http://microstrategy.com"
},
{
"type": "WEB",
"url": "http://www.yourcompany.com:8080/MicroStrategy/servlet/taskProc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-23X2-P68Q-C69P
Vulnerability from github – Published: 2022-06-10 00:00 – Updated: 2022-06-16 00:00A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
{
"affected": [],
"aliases": [
"CVE-2022-31386"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-09T14:15:00Z",
"severity": "CRITICAL"
},
"details": "A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.",
"id": "GHSA-23x2-p68q-c69p",
"modified": "2022-06-16T00:00:22Z",
"published": "2022-06-10T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31386"
},
{
"type": "WEB",
"url": "https://github.com/Fanli2012/nbnbk/issues/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-242G-GC8X-5MMF
Vulnerability from github – Published: 2026-08-24 12:31 – Updated: 2026-08-24 12:31Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
{
"affected": [],
"aliases": [
"CVE-2026-78277"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T12:16:55Z",
"severity": "MODERATE"
},
"details": "Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro \u003c= 3.1.12 versions.",
"id": "GHSA-242g-gc8x-5mmf",
"modified": "2026-08-24T12:31:40Z",
"published": "2026-08-24T12:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78277"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/fluentcampaign-pro/vulnerability/wordpress-fluentcrm-pro-plugin-3-1-12-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-242X-H644-MF6J
Vulnerability from github – Published: 2026-09-04 15:36 – Updated: 2026-09-04 15:36MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
{
"affected": [],
"aliases": [
"CVE-2026-85691"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T15:17:47Z",
"severity": "HIGH"
},
"details": "MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.",
"id": "GHSA-242x-h644-mf6j",
"modified": "2026-09-04T15:36:16Z",
"published": "2026-09-04T15:36:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85691"
},
{
"type": "WEB",
"url": "https://github.com/The-Vibe-Company/megaparse/issues/259"
},
{
"type": "WEB",
"url": "https://github.com/The-Vibe-Company/megaparse"
},
{
"type": "WEB",
"url": "https://github.com/The-Vibe-Company/megaparse/blob/megaparse-v0.0.55/libs/megaparse/src/megaparse/api/app.py"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/megaparse-0.0.55-server-side-request-forgery-via-post-v1-url"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.