CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- kubeflow model registryKubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation7.1 High
- misskey-dev misskeyMisskey: Lack of rate limiting and size restrictions in RSS fetching API8.7 High
- apache software foundation fesod (incubating)Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding9.1 Critical
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an...8.6 High
- nvidia aistore frameworkNVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an...8.6 High
- conductor-oss conductorconductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery6.9 Medium
- conductor-oss conductorconductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery6.9 Medium
- conductor-oss conductorconductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery6.9 Medium
- conductor-oss conductorconductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery5.3 Medium
- conductor-oss conductorconductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery5.3 Medium
- fit2cloud meterspherefit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery5.3 Medium
- gitlabServer-Side Request Forgery (SSRF) in GitLab3.5 Low
- sap se cloudOAuth2 SSRF vulnerability in SAP Cloud SDK for Python10.0 Critical
- No product listedA Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403...6.5 Medium
- ericlbuehler mistral.rsEricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery6.9 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field5.3 Medium
- elated-themes frappeFrappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit4.8 Medium
- spipSPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url5.3 Medium
- red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2, quay 3 +2 moreQuay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable6.4 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +9 more +11 moreOpenshift/console: openshift/console: authenticated ssrf via helm chart url fetch7.7 High
- progress software corporation marklogic serverServer-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector7.5 High
- unclecode crawl4aiCrawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch6.9 Medium
- unclecode crawl4aiCrawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder9.2 Critical
- progress software corporation marklogic serverServer-side request forgery in Progress MarkLogic Server Linux cloud deployments8.5 High
- progress software corporation marklogic serverServer-side request forgery in Progress MarkLogic Server Azure deployments8.5 High
- logicaldoc community editionLogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href5.3 Medium
- progress sharefile storage zones controllerUntrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller4.0 Medium
- progress sharefile storage zones controllerUnauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller6.5 Medium
- ollamaOllama Pull API name.go IsValid server-side request forgery6.9 Medium
- houtini-ai voice-analyser-mcphoutini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery5.3 Medium
- houtini-ai seo-crawler-mcphoutini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery5.3 Medium
- appwriteAppwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery6.9 Medium
- guy-hartstein company-research-agentCompany Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup6.9 Medium
- minifluxMiniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL5.3 Medium
- theopenco llmgatewayLLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url5.3 Medium
- casdoorCasdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery5.3 Medium
- 021is elvix-sdk021is elvix-sdk MCP Request index.ts server-side request forgery5.3 Medium
- studio-saelix senchoStudio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery5.3 Medium
- studio-saelix senchoStudio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery5.1 Medium
- heliconeHelicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution5.3 Medium
- builderius.io builderiusWordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability7.2 High
- bplugins streamcastWordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- mealie-recipes mealieMealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch2.3 Low
- 54yyyu zotero-mcpzotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool2.3 Low
- pdfmathtranslatePDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input6.9 Medium
- kortix-ai sunaKortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses2.3 Low
- pyloadpyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host6.4 Medium
- grid protection alliance openhistorian, openpdc, openpdc (docker image) +2 moreGrid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)5.3 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server...5.8 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server...7.7 High
- Show moreLoading…