cve.bz

CWE-918: Server-Side Request Forgery (SSRF), page 16

Filter

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

What the weakness is: CWE-918 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-664 Server Side Request Forgery Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-918, as MITRE names them. Credits.

Ask an AI about CWE-918

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-918: Server-Side Request Forgery and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/918.html and https://cve.bz/cve/cwe/918?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-75340EPSS 0.4%

    The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).

  2. 9.1CVE-2026-75332EPSS 0.4%

    Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().

  3. 3.7CVE-2025-62341EPSS 0.2%

    HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypas…

  4. 3.5CVE-2026-77573EPSS 0.2%

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal servic…

  5. 4.3CVE-2026-71172EPSS 0.3%

    Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request fo…

  6. 7.1CVE-2026-80350EPSS 0.4%

    OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetI…

  7. 8.7CVE-2026-80347EPSS 0.4%

    mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, an…

  8. 8.6CVE-2026-52776EPSS 0.4%

    Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request f…

  9. 7.2CVE-2026-45019EPSS 0.4%

    Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint with…

  10. 7.1CVE-2026-79788EPSS 0.4%

    In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result,…

  11. 10.0CVE-2026-76193EPSS 1.3%

    Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitr…

  12. 3.5CVE-2026-70548EPSS 0.3%

    Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

  13. 6.4CVE-2026-79717EPSS 0.4%

    A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, inclu…

  14. 8.5CVE-2026-70551EPSS 0.3%

    A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL.

  15. 7.1CVE-2026-55537EPSS 0.3%

    PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecuto…

  16. 6.8CVE-2026-55535EPSS 0.3%

    PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later reso…

  17. 8.5CVE-2026-55526EPSS 0.4%

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolv…

  18. 7.5CVE-2026-55525EPSS 0.5%

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an …

  19. 5.1CVE-2026-79671EPSS 0.3%

    Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-reso…

  20. 8.3CVE-2026-79659EPSS 0.4%

    Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitra…

  21. 9.1CVE-2026-55976EPSS 1.0%

    Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving …

  22. 8.7CVE-2026-78682EPSS 0.4%

    NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the request…

  23. 6.9CVE-2026-34964EPSS 0.4%

    Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inje…

  24. 5.3CVE-2026-77310EPSS 0.3%

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress bran…

  25. 8.4CVE-2026-76838EPSS 0.4%

    Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserve…

  26. 7.7CVE-2026-71366EPSS 0.6%

    A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets witho…

  27. 8.2CVE-2026-78385EPSS 0.4%

    RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its def…

  28. 4.9CVE-2026-78277EPSS 0.2%

    Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

  29. 6.4CVE-2026-78269EPSS 0.2%

    Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

  30. 8.3CVE-2026-10582EPSS 0.4%

    Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and t…

  31. 7.5CVE-2026-75975EPSS 0.2%

    fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is…

  32. 7.5CVE-2026-75899EPSS 0.2%

    fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested perce…

  33. 6.9CVE-2026-78205EPSS 0.4%

    BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 th…

  34. 5.3CVE-2026-78061EPSS 0.3%

    A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to s…

  35. 6.9CVE-2026-63311EPSS 0.3%

    NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during soc…

  36. 9.8CVE-2026-78003EPSS 0.8%

    The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which acc…

  37. 7.1CVE-2026-47735EPSS 0.4%

    Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`) blocked only `read_parquet(` and `arc_partition_agg(` via regex denylist. The br…

  38. 5.7CVE-2026-53509EPSS 0.4%

    CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arb…

  39. 7.7CVE-2026-54457EPSS 0.4%

    TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied J…

  40. 8.7CVE-2026-50288EPSS 0.5%

    SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTT…

  41. 5.5CVE-2026-63004EPSS 0.4%

    Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams,…

  42. 10.0CVE-2026-69502EPSS 0.8%

    Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

  43. 8.3CVE-2026-22681EPSS 0.3%

    OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can PO…

  44. 7.7CVE-2026-77775EPSS 0.6%

    Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with a…

  45. 2.7CVE-2026-13176EPSS 0.3%

    The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary…

  46. 4.3CVE-2026-61422EPSS 0.4%

    Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storag…

  47. 9.1CVE-2026-59085EPSS 0.6%

    Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. U…

  48. 8.8CVE-2026-50112EPSS 0.7%

    SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a tem…

  49. 2.2CVE-2026-77648EPSS 0.3%

    In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used.…

  50. 7.7CVE-2026-77646EPSS 0.4%

    A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.