CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- itzcrazykns vaneItzCrazyKns Vane Model Provider API route.ts server-side request forgery6.9 Medium
- calcom cal.diycalcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery2.3 Low
instagrapiPyPIinstagrapi: Unsafe signup challenge path handling in instagrapi6.5 Medium- subzeroid aiograpiaiograpi: Unsafe signup challenge path handling6.5 Medium
- nezhahq nezhaNezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification7.7 High
- baptistearno typebot.ioTypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks7.7 High
- baptistearno typebot.ioTypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation7.6 High
- baptistearno typebot.ioTypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls10.0 Critical
- devolutions serverImproper authorization in the Active Directory browsing feature in Devolutions Server allows a...7.1 High
- techjewel fluentcrm – email newsletter, automation, email marketing, email campaigns, optins, leads, and crm solutionFluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter5.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block2.1 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)6.8 Medium
- flaskbbFlaskBB: SSRF in get_image_info() via unrestricted avatar URL6.5 Medium
- nocodbNocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)4.3 Medium
- knplabs snappySnappy: SSRF and local file read via the xsl-style-sheet option6.9 Medium
- pyloadpyLoad: SSRF via HTTP Redirect Bypass in parse_urls API5.0 Medium
- apify crawlee-pythonSSRF via sitemap-derived URLs in Crawlee for Python2.3 Low
- wpdive nexa blocks – gutenberg blocks, page builder for gutenberg editor & fseNexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter5.4 Medium
- angular, red hat enterprise linux 8, fuse 7 +2 moreAngular: SSRF via Hostname Hijacking in @angular/platform-server8.8 High
- sillytavernSillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl8.5 High
- coderCoder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint6.5 Medium
- n8nn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint5.3 Medium
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL...9.3 Critical
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the...9.3 Critical
- tenable terrascanTerrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the...8.7 High
- axllent mailpitMailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer5.8 Medium
auth-fetch-mcpnpmauth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs8.2 High- haxtheweb @haxtheweb/open-apisHAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis8.7 High
- haxtheweb haxcms-nodejs, haxcms-php +1 moreHAXcms createSite SSRF Enables Arbitrary File Read7.1 High
- apache ofbizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access7.5 High
- apache ofbizApache OFBiz: Low-Privilege SSRF in Content Component7.3 High
- significant-gravitas autogptAutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server5.0 Medium
- No product listedscalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the...9.8 Critical
- steipete summarizeSummarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events4.6 Medium
- amir20 dozzleDozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)8.6 High
- statamic cmsStatamic: Server-Side Request Forgery via Glide5.4 Medium
- faraday project faradayFaraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)0.0 None
- spring-ai-community mcp-security, springaicommunity mcp security +1 moremcp-security: Unvalidated URL Fetching (SSRF)7.2 High
- mattermost, mattermost server +1 moreSSRF via Host Header Spoofing in Custom Slash Commands3.5 Low
- vercel aivercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery6.9 Medium
- coreworxlab caalCoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery6.9 Medium
- couchcmsCouchCMS 2.2.1 Server-Side Request Forgery via SVG upload5.3 Medium
- wwbn avideoAVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post6.5 Medium
- budibaseBudibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration7.7 High
- budibaseBudibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation7.7 High
- universal-tool-calling-protocol typescript-utcptypescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol4.7 Medium
- hmbown codewhaleCodeWhale: SSRF IPV6 bypass7.4 High
- hmbown codewhaleCodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool7.4 High
- openwebui open webui, open-webui +1 moreOpen WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`8.5 High
- Show moreLoading…