CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
@asymmetric-effort/specifyjsnpm@asymmetric-effort/specifyjs: No redirect target validation in secureFetch6.9 Medium@asymmetric-effort/specifyjsnpm@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction6.9 Medium@asymmetric-effort/specifyjsnpm@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)6.9 Medium- asymmetric-effort specifyjs@asymmetric-effort/specifyjs: URL parse failure silently allows request8.7 High
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the network and low privileges could exploit a Server-Side...9.9 Critical
- ubiquiti inc unifi talk applicationA malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF)...7.5 High
- ubiquiti inc cloud gateways, cloud keys, dream machines +40 more +42 moreA malicious actor with access to the network and low privileges could exploit a Server-Side...7.7 High
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- openidc liboauth2Server-Site Request Forgery in liboauth25.1 Medium
- eclipse foundation csi - piaPIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as…8.2 High
- apify apify-mcp-serverActor MCP path authority injection leaks Apify token8.1 High
- linuxfoundation oras, oras-project oras-go +1 moreoras-go: credential forwarding via unvalidated Location header in blob upload7.5 High
- oras-project oras-gooras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens2.1 Low
- suse rancher, rancher fleet +1 moreRancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml5.0 Medium
- suse rancher, rancher fleet +1 moreSUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components8.3 High
- surrealdbSurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect5.3 Medium
- ymw0407 auth-fetch-mcpauth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback7.4 High
- vmoranv jshookmcp@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization4.3 Medium
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server...7.8 High
- pretix pretix-oppwaSSRF with API key leak in pretix-oppwa9.0 Critical
- open-webuiOpen WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web5.3 Medium
- ibm watsonx.data intelligenceVulnerabilities found in Watson Data Intelligence4.3 Medium
- ibm langflow oss, langflow +1 moreSSRF via HTTP Redirect Following in Langflow API Request Component8.5 High
- ibm langflow oss, langflow +1 moreDNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component7.1 High
- ibm langflow oss, langflow +1 moreSSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection8.2 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability7.1 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability8.5 High
- ibm websphere extreme scaleIBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol6.0 Medium
- sigstore fulcioFulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage8.7 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)8.6 High
- theforeman foreman, red hat satellite 6, redhat satellite +2 moreForeman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config4.4 Medium
- pinpoint-apm pinpointPinpoint - Server-Side Request Forgery via Alarm Webhook Registration6.3 Medium
- zedeus nitterNitter - Server-Side Request Forgery in /video Media Proxy Endpoint7.7 High
- snowflake cliSnowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load4.1 Medium
- gitbucketGitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery5.3 Medium
- statamic cmsStatamic: Server-Side Request Forgery via Glide (DNS rebinding)4.9 Medium
- aimeos pagibleAimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy3.0 Low
@cardano402/mcp-servernpm@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url0.0 None- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`10.0 Critical
github.com/apernet/hysteria/coreGo,github.com/apernet/hysteria/core/v2Go +1 moreHysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF7.4 High- fluent fluentdFluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`7.2 High
- canonical lxdSSRF via image import from URL allows internal network probing by authenticated users5.0 Medium
- significant-gravitas autogptAutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access8.5 High
- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- chris carlevato utm.codesWordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- mattermost, mattermost server +1 moreSSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server6.5 Medium
- danpros htmlyHTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import...2.1 Low
- wso2 api managerUnauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager8.3 High
- rapid7 insightconnect markdown pluginServer-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin4.8 Medium
- Show moreLoading…