CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- horizon921 mcpilothorizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery6.9 Medium
- hekmon8 jenkins-server-mcphekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery5.3 Medium
- indrasishbanerjee aem-mcp-serverindrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery5.3 Medium
- apache fesod, apache software foundation fesod (incubating) +1 moreApache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF5.3 Medium
- jeecgboot the server processes these urlsjeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery5.3 Medium
- No product listedJeecgBoot test server-side request forgery5.3 Medium
- No product listedJeecgBoot edit WordUtil.addImage server-side request forgery5.3 Medium
- aider-ai aiderAider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery5.3 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings5.5 Medium
- nezhahq nezhaNezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host6.4 Medium
- cc-tweakedCC-Tweaked has an SSRF Protection Bypass with NAT647.1 High
- koelKoel Vulnerable to SSRF via Podcast Episode Enclosure URLs7.7 High
- labring fastgptFastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API7.7 High
- spatie laravel-medialibrarySpatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible7.5 High
- gotenbergGotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes7.5 High
- jxxghp moviepilotMoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)8.6 High
- shibby tomatoShibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery6.9 Medium
- redhat openshift router, red hat openshift container platform 4, openshift container platform 4.17 +7 more +9 moreOpenshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation7.7 High
mautic/corePackagistMautic Focus component Vulnerable to SSRF6.4 Medium- red hat quay 3Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints4.1 Medium
- elastic kibanaServer-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access6.3 Medium
- elastic kibanaServer-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access7.7 High
- musicplayerdaemon mpdMusic Player Daemon < 0.24.11 SSRF via CurlInputPlugin6.9 Medium
- oscal-compass compliance-trestlecompliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem6.7 Medium
- learningcircuit local-deep-researchLocal Deep Research: SSRF bypass in `safe_get`5.0 Medium
- jpadilla pyjwtPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes4.2 Medium
- flowintelFlowIntel external reference URL probe allows server-side request forgery6.2 Medium
- bensibley independent analytics – wordpress analytics pluginIndependent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route6.5 Medium
- budibaseBudibase: Unvalidated VectorDB Host Parameter Enables SSRF5.3 Medium
- budibaseBudibase: SSRF via User-Controlled queryId in Automation Execute Query Step5.1 Medium
- budibaseBudibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection7.7 High
- budibaseBudibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata8.5 High
- jenkins active directory, jenkins project active directory plugin +1 moreJenkins Active Directory Plugin follows LDAP referrals by default6.6 Medium
- jenkins ldap, jenkins project ldap plugin +1 moreJenkins LDAP Plugin follows LDAP referrals6.6 Medium
- github enterprise serverServer-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint9.2 Critical
- github enterprise serverServer-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint7.0 High
- 1panel-dev maxkbMaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch5.1 Medium
- 1panel-dev maxkbMaxKB: Unauthenticated SSRF via Workflow Template Import6.3 Medium
- 1panel-dev maxkbMaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy6.3 Medium
- google cloud apigee-xServer-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.9.2 Critical
- ibm webmethods integration (on prem) -integration server, webmethods integration server +1 moreIBM webMethods Integration Sever is vulnerable to server-side request forgery5.4 Medium
- e107inc e107e107: Server-Side Request Forgery (SSRF) in the remote file fetcher4.3 Medium
- apache flink kubernetes operatorApache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator6.5 Medium
- karakeep-app karakeepKarakeep has a SSRF Protection Bypass via Redirect Handling7.6 High
- apache shiro, apache software foundation shiro jakarta ee module +1 moreApache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)5.1 Medium
- bulwarkmail webmailRoundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient...7.2 High
- benoitc hackneySSRF allowlist bypass via percent-encoded host in hackney6.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery5.1 Medium
- Show moreLoading…