CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreVirt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip6.4 Medium
- netflix lemurLemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR9.9 Critical
- netflix lemurLemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates6.3 Medium
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 moreApicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation7.4 High
- open health imaging foundation (ohif) dicom web viewer frameworkOHIF Viewers DICOM Server-Side request forgery8.3 High
- 1panel-dev maxkbMaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters5.3 Medium
- samuelclay newsblurNewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint6.3 Medium
- hcengineering platformHuly Platform - Server-Side Request Forgery via /import Endpoint6.3 Medium
- tooljetToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise8.3 High
- danny-avila librechatLibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs7.7 High
- appsmithAppsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist5.3 Medium
- appsmithAppsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route8.9 High
- mastodonMastodon: SSRF protection bypass on older Ruby versions8.6 High
- mastodonMastodon: SSRF Bypass via IPv6 Unspecified Address (::)8.7 High
- drupal openai provider, openai provider project provider +1 moreOpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-0533.3 Low
- tryghost ghostGhost: Private IP filtering bypass to make server-side requests to internal services5.8 Medium
- tryghost ghostGhost: Server-side request forgery via DNS rebinding in external request handling4.0 Medium
- tryghost ghostGhost: Mobiledoc image-size fetch SSRF5.4 Medium
- payara serverPayara Server Full has a Cross-Site Request Forgery vulnerability7.3 High
- jenkins assembla, jenkins project assembla plugin +1 moreJenkins Assembla Plugin has an XXE vulnerability7.1 High
- pentestifySSRF in Pentestify PDF generation endpoint via Host header6.9 Medium
- bytuncay kargo takipKargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter7.2 High
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter6.4 Medium
- abhisheksaha11 url previewURL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter7.2 High
- fasterxml jackson-databindjackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)5.3 Medium
- openstack swiftOpenStack Swift vulnerable to authenticated server-side request forgery5.3 Medium
- gogsGogs: Migration Redirect Bypass Leads to Internal Repository Theft8.7 High
- budibaseBudibase: Potential SSRF DNS rebinding bypass in outbound fetch validation8.5 High
- gogsGogs: SSRF in webhook deliveries8.3 High
- paymenterPaymenter: Blind Unauthenticated SSRF on the Paypal gateway module5.3 Medium
- openidentityplatform openamOpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`5.3 Medium
- ibm sterling b2b integrator, sterling file gateway, watson speech services cartridge +2 moreIBM Sterling File Gateway SQL Injection6.0 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by server-side request forgery7.4 High
- No product listedactivepieces File URL file.ts handleUrlFile server-side request forgery5.3 Medium
- berriai litellmBerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery5.3 Medium
- berriai litellmBerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery5.3 Medium
- avideoAVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter6.1 Medium
- cap-go capgoCapgo - Server-Side Request Forgery via Webhook URL Validation5.3 Medium
- surrealdbSurrealDB before 3.1.5 SSRF via JWKS URL Redirect5.1 Medium
- merill lokkaLokka: Azure Resource Manager URL path validation issue8.7 High
- python-zeep zeep, mvantellingen python-zeep +1 moreZeep SSRF because Settings.forbid_external is not enforced5.9 Medium
- ihor-sokoliuk mcp-searxngmcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`7.1 High
- axllent mailpitMailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808)5.8 Medium
- craftcms cmsCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs6.9 Medium
- dbarzin mercatorMercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)5.3 Medium
- gohugo hugoHugo security.http.urls deny rules bypassed by alternate IPv4 encodings4.6 Medium
- red hat ansible automation platform 2Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential6.3 Medium
- pontedilana php-weasyprintPhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option6.5 Medium
- nl-portal nl-portal-backend-librariesNL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)5.3 Medium
- jleehr canto-saas-apicanto-saas-api: Authenticated API requests can be redirected via unencoded path variables4.8 Medium
- Show moreLoading…