Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

5920 vulnerabilities reference this CWE, most recent first.

GHSA-659X-HM75-HPV7

Vulnerability from github – Published: 2026-04-20 06:31 – Updated: 2026-04-28 23:19
VLAI
Summary
AgentScope vulnerable to Server-Side Request Forgery
Details

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "agentscope"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-6604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-28T23:19:28Z",
    "nvd_published_at": "2026-04-20T05:16:15Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-659x-hm75-hpv7",
  "modified": "2026-04-28T23:19:28Z",
  "published": "2026-04-20T06:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6604"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/YLChen-007/e3e0741b297d8c2ffca59b6350d4c657"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/agentscope-ai/agentscope"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/792224"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/358239"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/358239/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "AgentScope vulnerable to Server-Side Request Forgery"
}

GHSA-65FM-2JGR-J7QQ

Vulnerability from github – Published: 2024-08-05 21:29 – Updated: 2024-08-05 21:29
VLAI
Summary
memos vulnerable to Server-Side Request Forgery in /api/resource
Details

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/usememos/memos"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-29030"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-05T21:29:24Z",
    "nvd_published_at": "2024-04-19T15:15:50Z",
    "severity": "MODERATE"
  },
  "details": "memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the `/api/resource` that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.",
  "id": "GHSA-65fm-2jgr-j7qq",
  "modified": "2024-08-05T21:29:24Z",
  "published": "2024-08-05T21:29:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29030"
    },
    {
      "type": "WEB",
      "url": "https://github.com/usememos/memos/commit/bbd206e8930281eb040cc8c549641455892b9eb5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/usememos/memos"
    },
    {
      "type": "WEB",
      "url": "https://github.com/usememos/memos/blob/06dbd8731161245444f4b50f4f9ed267f7c3cf63/api/v1/resource.go#L83"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2023-154_GHSL-2023-156_memos"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "memos vulnerable to Server-Side Request Forgery in /api/resource"
}

GHSA-65H7-9WRW-629C

Vulnerability from github – Published: 2026-09-11 22:02 – Updated: 2026-09-11 22:02
VLAI
Summary
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
Details

Summary

The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.

FrontMCP latest release v1.2.1 and current main still call OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON() from mcp-from-openapi 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.

This is a latest-version bypass of the previous fix. A direct http://127.0.0.1 $ref control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.

Latest versions checked

  • frontmcp npm latest: 1.2.1
  • @frontmcp/adapters npm latest: 1.2.1
  • mcp-from-openapi npm latest: 2.3.0
  • FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944
  • FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756

The release tag and current main both keep mcp-from-openapi 2.3.0 in package.json and libs/adapters/package.json, and both keep the OpenAPI adapter forwarding untrusted url, spec, and loadOptions.refResolution into OpenAPIToolGenerator.

Technical details

FrontMCP's OpenAPI adapter reaches the affected dependency paths:

  • libs/adapters/src/openapi/openapi.adapter.ts imports OpenAPIToolGenerator from mcp-from-openapi.
  • loadOpenAPISpec() calls OpenAPIToolGenerator.fromURL(this.options.url, ...) and forwards loadOptions.refResolution.
  • The same method calls OpenAPIToolGenerator.fromJSON(this.options.spec, ...) and forwards loadOptions.refResolution.

In mcp-from-openapi 2.3.0, the patched guard is applied before the HTTP resolver fetches an external $ref. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.

As a result, these URLs are accepted by the guard but cause a loopback request from the backend:

  • http://127.0.0.1.nip.io:<port>/schema.json, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.
  • http://127.0.0.1.nip.io:<port>/redirect, because the first host passes and the actual request follows a redirect to http://127.0.0.1:<port>/schema.json.
  • http://[::ffff:127.0.0.1]:<port>/schema.json and http://[::ffff:7f00:1]:<port>/schema.json, because IPv4-mapped IPv6 loopback is not normalized and denied.

OpenAPIToolGenerator.fromURL() is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external $ref fix bypass.

Reproduction

The attached local PoC starts a loopback canary and loads generated OpenAPI specs using mcp-from-openapi 2.3.0. The request body schema contains a single external $ref for each test case. The canary records every backend-origin request.

Run:

cd /home/unkn0wn/security_audit/frontmcp-ssrf-poc
node repro-frontmcp-latest-ssrf-bypasses.mjs

Important output from a fresh run on 2026-05-25:

{"name":"direct-127-denied-control","kind":"external_ref","refUrl":"http://127.0.0.1:45117/schema.json","ok":false,"hitCount":0,"hits":[]}
{"name":"dns-name-to-127-bypass","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"dns-name-to-127-bypass-with-allowedHosts","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"redirect-to-127-after-allowed-host","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/redirect","ok":true,"hitCount":2,"hits":[{"url":"/redirect","host":"127.0.0.1.nip.io:45117","authorization":null},{"url":"/schema.json","host":"127.0.0.1:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-dotted-bypass","kind":"external_ref","refUrl":"http://[::ffff:127.0.0.1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-hex-bypass","kind":"external_ref","refUrl":"http://[::ffff:7f00:1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"external-refs-disabled-control","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":0,"hits":[]}

Controls:

  1. Direct loopback $ref is denied and the canary records zero requests.
  2. Numeric IPv4 variants tested as parser controls were denied with zero requests.
  3. Default file:// resolution was denied in this runtime.
  4. Setting refResolution.allowedProtocols: [] prevents the external request, but this is not the default.

Impact

The previous advisory documented SSRF during untrusted OpenAPI $ref dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.

The impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.

Remediation

  1. Do not rely on parsed hostname denylist checks for external $ref URLs.
  2. Resolve hostnames before the request and reject loopback, private, link-local, multicast, unspecified, and metadata ranges.
  3. Normalize IPv4-mapped IPv6 before range checks.
  4. Revalidate every redirect target before following it, or disable redirects during external $ref dereferencing.
  5. Pin the validated IP to the actual request with a custom dispatcher, lookup hook, or equivalent connect-time control.
  6. Apply the same protected client to fromURL() initial spec loads.
  7. Consider disabling external refs by default for untrusted OpenAPI specs and requiring explicit allowlists.
  8. Add regression tests for direct loopback, DNS-to-loopback, redirect-to-loopback, IPv4-mapped IPv6, numeric IP forms, file refs, and disabled external refs.
Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcp-from-openapi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@frontmcp/adapters"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.1"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "frontmcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.1"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:02:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.\n\nFrontMCP latest release v1.2.1 and current main still call `OpenAPIToolGenerator.fromURL()` and `OpenAPIToolGenerator.fromJSON()` from `mcp-from-openapi` 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.\n\nThis is a latest-version bypass of the previous fix. A direct `http://127.0.0.1` `$ref` control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.\n\n## Latest versions checked\n\n- `frontmcp` npm latest: 1.2.1\n- `@frontmcp/adapters` npm latest: 1.2.1\n- `mcp-from-openapi` npm latest: 2.3.0\n- FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944\n- FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756\n\nThe release tag and current main both keep `mcp-from-openapi` 2.3.0 in `package.json` and `libs/adapters/package.json`, and both keep the OpenAPI adapter forwarding untrusted `url`, `spec`, and `loadOptions.refResolution` into `OpenAPIToolGenerator`.\n\n## Technical details\n\nFrontMCP\u0027s OpenAPI adapter reaches the affected dependency paths:\n\n- `libs/adapters/src/openapi/openapi.adapter.ts` imports `OpenAPIToolGenerator` from `mcp-from-openapi`.\n- `loadOpenAPISpec()` calls `OpenAPIToolGenerator.fromURL(this.options.url, ...)` and forwards `loadOptions.refResolution`.\n- The same method calls `OpenAPIToolGenerator.fromJSON(this.options.spec, ...)` and forwards `loadOptions.refResolution`.\n\nIn `mcp-from-openapi` 2.3.0, the patched guard is applied before the HTTP resolver fetches an external `$ref`. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.\n\nAs a result, these URLs are accepted by the guard but cause a loopback request from the backend:\n\n- `http://127.0.0.1.nip.io:\u003cport\u003e/schema.json`, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.\n- `http://127.0.0.1.nip.io:\u003cport\u003e/redirect`, because the first host passes and the actual request follows a redirect to `http://127.0.0.1:\u003cport\u003e/schema.json`.\n- `http://[::ffff:127.0.0.1]:\u003cport\u003e/schema.json` and `http://[::ffff:7f00:1]:\u003cport\u003e/schema.json`, because IPv4-mapped IPv6 loopback is not normalized and denied.\n\n`OpenAPIToolGenerator.fromURL()` is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external `$ref` fix bypass.\n\n## Reproduction\n\nThe attached local PoC starts a loopback canary and loads generated OpenAPI specs using `mcp-from-openapi` 2.3.0. The request body schema contains a single external `$ref` for each test case. The canary records every backend-origin request.\n\nRun:\n\n```bash\ncd /home/unkn0wn/security_audit/frontmcp-ssrf-poc\nnode repro-frontmcp-latest-ssrf-bypasses.mjs\n```\n\nImportant output from a fresh run on 2026-05-25:\n\n```json\n{\"name\":\"direct-127-denied-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1:45117/schema.json\",\"ok\":false,\"hitCount\":0,\"hits\":[]}\n{\"name\":\"dns-name-to-127-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"dns-name-to-127-bypass-with-allowedHosts\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"redirect-to-127-after-allowed-host\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/redirect\",\"ok\":true,\"hitCount\":2,\"hits\":[{\"url\":\"/redirect\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null},{\"url\":\"/schema.json\",\"host\":\"127.0.0.1:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-dotted-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:127.0.0.1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-hex-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:7f00:1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"external-refs-disabled-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":0,\"hits\":[]}\n```\n\nControls:\n\n1. Direct loopback `$ref` is denied and the canary records zero requests.\n2. Numeric IPv4 variants tested as parser controls were denied with zero requests.\n3. Default `file://` resolution was denied in this runtime.\n4. Setting `refResolution.allowedProtocols: []` prevents the external request, but this is not the default.\n\n## Impact\n\nThe previous advisory documented SSRF during untrusted OpenAPI `$ref` dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.\n\nThe impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.\n\n## Remediation\n\n1. Do not rely on parsed hostname denylist checks for external `$ref` URLs.\n2. Resolve hostnames before the request and reject loopback, private, link-local, multicast, unspecified, and metadata ranges.\n3. Normalize IPv4-mapped IPv6 before range checks.\n4. Revalidate every redirect target before following it, or disable redirects during external `$ref` dereferencing.\n5. Pin the validated IP to the actual request with a custom dispatcher, lookup hook, or equivalent connect-time control.\n6. Apply the same protected client to `fromURL()` initial spec loads.\n7. Consider disabling external refs by default for untrusted OpenAPI specs and requiring explicit allowlists.\n8. Add regression tests for direct loopback, DNS-to-loopback, redirect-to-loopback, IPv4-mapped IPv6, numeric IP forms, file refs, and disabled external refs.",
  "id": "GHSA-65h7-9wrw-629c",
  "modified": "2026-09-11T22:02:04Z",
  "published": "2026-09-11T22:02:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/agentfront/frontmcp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix"
}

GHSA-65H7-C7C4-MGHX

Vulnerability from github – Published: 2026-05-11 18:31 – Updated: 2026-05-18 15:28
VLAI
Summary
MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
Details

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The _create_webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the _send_webhook_request() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.

Severity
7.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mlflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-2393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T15:28:44Z",
    "nvd_published_at": "2026-05-11T18:16:31Z",
    "severity": "HIGH"
  },
  "details": "A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter without validation, and the `_send_webhook_request()` function in `mlflow/webhooks/delivery.py` sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.",
  "id": "GHSA-65h7-c7c4-mghx",
  "modified": "2026-05-18T15:28:44Z",
  "published": "2026-05-11T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2393"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/commit/64aa0ab7207f9c649b59ba1a5f40d82196817389"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mlflow/mlflow"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/04ef100d-06b5-4a70-95b1-b7be23aa8150"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability"
}

GHSA-65PC-QFWH-RRGX

Vulnerability from github – Published: 2026-08-04 18:31 – Updated: 2026-08-04 18:31
VLAI
Details

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-47616"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-04T18:16:51Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.",
  "id": "GHSA-65pc-qfwh-rrgx",
  "modified": "2026-08-04T18:31:29Z",
  "published": "2026-08-04T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47616"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NVIDIA/product-security/tree/main/2026/5842"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47616"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-65PX-3FQ7-92H3

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-13 18:30
VLAI
Details

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-13233"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T22:16:39Z",
    "severity": "CRITICAL"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.",
  "id": "GHSA-65px-3fq7-92h3",
  "modified": "2026-07-13T18:30:33Z",
  "published": "2026-07-11T00:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13233"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-053"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-65R5-237M-62HM

Vulnerability from github – Published: 2024-05-17 09:31 – Updated: 2024-05-17 09:31
VLAI
Details

Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-4789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T09:15:45Z",
    "severity": "MODERATE"
  },
  "details": "Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-65r5-237m-62hm",
  "modified": "2024-05-17T09:31:03Z",
  "published": "2024-05-17T09:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4789"
    },
    {
      "type": "WEB",
      "url": "https://stylemixthemes.com/cost-calculator-plugin"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6840350-7ff4-4ec2-bf2b-94ce6f782537?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-65RP-7R2J-RMM6

Vulnerability from github – Published: 2026-08-10 09:31 – Updated: 2026-08-11 21:32
VLAI
Details

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl=<post_id> on any aiovg_videos post (public/video.php, AIOVG_Public_Video::download_video()), which reads the post's mp4 meta value and streams that URL's response back to the requester.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T07:16:51Z",
    "severity": "MODERATE"
  },
  "details": "All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=\u003cpost_id\u003e` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post\u0027s `mp4` meta value and streams that URL\u0027s response back to the requester.",
  "id": "GHSA-65rp-7r2j-rmm6",
  "modified": "2026-08-11T21:32:31Z",
  "published": "2026-08-10T09:31:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19075"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/ad70162f-5514-41b8-84af-c79c2f881567"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6669-Q2H5-85Q9

Vulnerability from github – Published: 2022-03-19 00:01 – Updated: 2022-03-26 00:00
VLAI
Details

An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-45967"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-18T05:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.",
  "id": "GHSA-6669-q2h5-85q9",
  "modified": "2022-03-26T00:00:49Z",
  "published": "2022-03-19T00:01:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45967"
    },
    {
      "type": "WEB",
      "url": "https://kerbit.io/research/read/blog/4"
    },
    {
      "type": "WEB",
      "url": "https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html"
    },
    {
      "type": "WEB",
      "url": "https://www.pascom.net/doc/en/release-notes"
    },
    {
      "type": "WEB",
      "url": "https://www.pascom.net/doc/en/release-notes/pascom19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-666W-8983-6664

Vulnerability from github – Published: 2026-08-05 12:31 – Updated: 2026-08-05 12:31
VLAI
Details

Paperless-ngx's MailAccountViewSet.test() action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request. The test connection then authenticates to the caller-specified server using the real stored credentials. A user holding only object-level change_mailaccount permission on the target account (not full admin) can redirect the test connection to an attacker-controlled IMAP host, causing the real stored IMAP password or OAuth token to be sent to that host.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-71244"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T11:16:27Z",
    "severity": "MODERATE"
  },
  "details": "Paperless-ngx\u0027s MailAccountViewSet.test() action, when called with an existing account\u0027s ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request. The test connection then authenticates to the caller-specified server using the real stored credentials. A user holding only object-level change_mailaccount permission on the target account (not full admin) can redirect the test connection to an attacker-controlled IMAP host, causing the real stored IMAP password or OAuth token to be sent to that host.",
  "id": "GHSA-666w-8983-6664",
  "modified": "2026-08-05T12:31:32Z",
  "published": "2026-08-05T12:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71244"
    },
    {
      "type": "WEB",
      "url": "https://github.com/paperless-ngx/paperless-ngx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list