CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- budibaseBudibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect8.2 High
- unknown pixelavoPixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX5.3 Medium
- thumborThumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot8.2 High
- contaoContao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module3.1 Low
- bank-vaults vault-secrets-webhookvault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API9.6 Critical
- hackingrepo dssrf-jsdssrf: any users using 1.1.1.1 DNS is impacted by SSRF8.7 High
nltkPyPINatural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode8.6 High- ccyl13 pentestifyServer-Side Request Forgery in Pentestify PDF export via unvalidated image URLs5.3 Medium
- google mcp-toolbox, mcp toolbox for databases +1 moreServer-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox8.0 High
- No product listedA Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3...6.5 Medium
- arnasdon wacrmWACRM: SSRF via the automation `send_webhook` action6.4 Medium
- lmsys sglangCVE-2026-159746.5 Medium
- 1panel-dev maxkbMaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation5.3 Medium
- leantimeLeantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()8.4 High
- kanboardKanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation8.4 High
- kyegomez swarmsSwarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass7.7 High
- malach-it borutaServer-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching6.9 Medium
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url6.8 Medium
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)7.6 High
- red hat cost management 4, redhat cost management metrics operator +1 moreProject-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address7.6 High
- red hat certificate system 10, certificate system 10.4 eus for rhel-8, certificate system 11 +6 more +8 moreDogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects5.8 Medium
- eclipse foundation csi - piaUnauthenticated SSRF in PIA via OIDC issuer allowlist bypass8.8 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 moreVercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection6.8 Medium
- linuxfabrik monitoring-pluginsLinuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins8.3 High
- linuxfabrik monitoring-pluginslinuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect6.0 Medium
- flytohub flyto-coreFlyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)8.5 High
- flytohub flyto-coreFlyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration9.3 Critical
- hashicorp toolingconsul-mcp-server vulnerable to server side request forgery leading to token exposure8.6 High
- flytohub flyto-coreFlyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation8.5 High
- prebid prebid-server, server +1 moreprebid-server's request forgery vulnerability allows for possible host environment data extraction10.0 Critical
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`6.1 Medium
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`7.4 High
- blendmedia wp cta – call now button, sticky button & call to action builderWP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery4.9 Medium
- apache traffic serverApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification8.2 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding7.5 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)8.2 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects8.2 High
- tigroumeow media cleaner: clean your wordpress!Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery4.1 Medium
- hashicorp toolingterraform-mcp-server vulnerable to server side request forgery leading to token exposure8.6 High
- cordea oauthOAuth: Cross-origin token-request redirects can expose signed request metadata7.2 High
- @novu application-generic, novuhq novu +1 moreNovu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition6.8 Medium
- appium java-clientAppium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor8.2 High
- pivotickPivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests5.1 Medium
- subtle web inc formcraftWordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- quantumcloud simple link directory proWordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- jfrog artifactoryPotential server-side request forgery in Artifactory Ansible repository handling6.8 Medium
- jfrog artifactoryServer-Side Request Forgery (SSRF) via Terraform Remote repository6.5 Medium
- jfrog artifactoryServer-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository6.5 Medium
- jfrog artifactoryImproper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability6.5 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moreServer-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool6.0 Medium
- Show moreLoading…