Weakness (CWE)
CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
How to prevent it (3 mitigations)
-
Implementation, Operation
If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
-
Implementation, Operation
If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
When constructing outgoing requests from input strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
Source: MITRE CWE-918
3,802 results · Feed
-
High 8.3
Server-Side Request Forgery in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send reque…
-
Medium 5.3
Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing s…
-
Medium 5.3
Server-side request forgery via crs member of GeoJSON geometries
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause ser…
-
High 7.7
Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at …
-
Medium 5.3
AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api…
-
Medium 4.3
SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass
SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Aut…
-
Medium 4.1
SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method who…
-
Low 3.3
SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQ…
-
Medium 5.3
Server-Side Request Forgery in extension "Mail" (mail)
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
-
Critical 9.2
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
-
Medium 5.8
Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read th…
-
Medium 5.3
AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request for…
-
Critical 9.1
CVE-2026-120630
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsi…
-
High 7.6
Rancher meta proxy allowlist bypass leading to server-side request forgery
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it…
-
Medium 5.4
Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;…
-
Critical 9.8
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredential…
-
High 7.1
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled…
-
Medium 6.8
Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer…
-
Medium 5.3
Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image re…
-
Medium 6.5
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the host, port and other …
-
Critical 9.1
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_val…
-
High 8.6
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config…
-
Low 2.3
Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An attacker controlling a do…
-
Medium 6.4CVE-2026-119712 Public exploit
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTM…
-
Medium 5.8
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, in…
-
Low 3.1
Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loop…
-
Medium 6.5
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blocke…
-
Low 2.7
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A hig…
-
High 7.1
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, the…
-
Medium 5.3
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers ca…
-
Low 3.7
phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port …
-
Medium 4.3
Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
-
High 8.7
Boundary vulnerable to server-side request forgery in Vault credential store
HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to …
-
Medium 6.1
Botan: Online OCSP redirects enable blind requests to internal HTTP services
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attack…
-
Medium 5.3
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to fo…
-
Medium 5.0
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
-
Medium 4.3
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
-
Medium 4.3
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
-
Medium 5.4
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
-
Medium 5.3
Server-Side Request Forgery in BMC ITSM SmartIT
Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.