Skip to content
OpenAdvisories

Weakness (CWE)

CWE-918: Server-Side Request Forgery

Base Incomplete

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

How to prevent it (3 mitigations)

  1. Implementation, Operation

    If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  2. Implementation, Operation

    If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

  3. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

    When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.

Source: MITRE CWE-918

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-83548 Exploited Public exploit Scanner template

    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…

    SonicWall SMA1000 Network devices
    KEV Sep 2, 2026
  • Critical 9.3
    CVE-2026-64849 Exploited Public exploit Scanner template EPSS 10%

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

    MLflow MLflow mlflow PyPI
    KEV Aug 19, 2026
  • Critical 10.0
    CVE-2026-15409 Exploited · Ransomware Public exploit Scanner template

    A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A…

    SonicWall SMA1000 Network devices
    KEV Jul 14, 2026
  • Critical 10.0
    CVE-2026-49869 Exploited Public exploit

    Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a su…

    kestra-io kestra
    KEV Sep 2, 2026
  • Critical 9.0
    CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    mod_proxy SSRF

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
    KEV Dec 1, 2021
  • Critical 9.1
    CVE-2021-34473 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21985 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtua…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-21975 Exploited · Ransomware Public exploit Scanner template EPSS 78%

    Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious acto…

    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2021-22986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12…

    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-26855 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021