CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4736 vulnerabilities reference this CWE, most recent first.
GHSA-28JJ-P35H-662J
Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-08 00:00Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.
{
"affected": [],
"aliases": [
"CVE-2022-27907"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-30T16:15:00Z",
"severity": "MODERATE"
},
"details": "Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.",
"id": "GHSA-28jj-p35h-662j",
"modified": "2022-04-08T00:00:32Z",
"published": "2022-03-31T00:00:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27907"
},
{
"type": "WEB",
"url": "https://sonatype.com"
},
{
"type": "WEB",
"url": "https://support.sonatype.com/hc/en-us/articles/5011047953555"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-28PF-M5G8-4RQM
Vulnerability from github – Published: 2025-03-28 12:31 – Updated: 2026-04-01 18:34Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP allows Server Side Request Forgery. This issue affects WP Compress for MainWP: from n/a through 6.30.03.
{
"affected": [],
"aliases": [
"CVE-2025-31076"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-28T10:15:16Z",
"severity": "MODERATE"
},
"details": "Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP allows Server Side Request Forgery. This issue affects WP Compress for MainWP: from n/a through 6.30.03.",
"id": "GHSA-28pf-m5g8-4rqm",
"modified": "2026-04-01T18:34:11Z",
"published": "2025-03-28T12:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31076"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-compress-mainwp/vulnerability/wordpress-wp-compress-for-mainwp-plugin-6-30-03-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-28V8-9MR3-438F
Vulnerability from github – Published: 2024-08-01 06:30 – Updated: 2024-08-01 06:30The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2024-2090"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-01T05:15:09Z",
"severity": "MODERATE"
},
"details": "The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-28v8-9mr3-438f",
"modified": "2024-08-01T06:30:34Z",
"published": "2024-08-01T06:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2090"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/remote-content-shortcode"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec93f360-2eed-4858-b36f-8cc17f7b4ac1?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2928-R2W9-GM4X
Vulnerability from github – Published: 2025-10-21 18:30 – Updated: 2025-12-08 18:30Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
{
"affected": [],
"aliases": [
"CVE-2025-62763"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-21T17:15:41Z",
"severity": "MODERATE"
},
"details": "Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.",
"id": "GHSA-2928-r2w9-gm4x",
"modified": "2025-12-08T18:30:24Z",
"published": "2025-10-21T18:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62763"
},
{
"type": "WEB",
"url": "https://blog.zimbra.com/2025/10/patch-release-update-zimbra-10-1-12"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Security_Center"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12#Security_Fixes"
},
{
"type": "WEB",
"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2944-57XV-2682
Vulnerability from github – Published: 2026-07-02 19:07 – Updated: 2026-07-02 19:07Finding
Location: core/src/shared/secure-fetch.ts:33-35
data: URIs were allowed without any restriction. While data: URIs don't make network requests, they can be used for memory exhaustion via very large data URIs.
Status
Fixed in v0.2.136 — data: URIs are now limited to 1MB. URIs exceeding this limit throw an error.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@asymmetric-effort/specifyjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.136"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T19:07:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Finding\n\n**Location**: `core/src/shared/secure-fetch.ts:33-35`\n\n`data:` URIs were allowed without any restriction. While `data:` URIs don\u0027t make network requests, they can be used for memory exhaustion via very large data URIs.\n\n## Status\n\n**Fixed in v0.2.136** \u2014 `data:` URIs are now limited to 1MB. URIs exceeding this limit throw an error.",
"id": "GHSA-2944-57xv-2682",
"modified": "2026-07-02T19:07:44Z",
"published": "2026-07-02T19:07:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/asymmetric-effort/specifyjs/security/advisories/GHSA-2944-57xv-2682"
},
{
"type": "WEB",
"url": "https://github.com/asymmetric-effort/specifyjs/commit/25d1fb491d99479efdf501f5f75e0bb80c908f0a"
},
{
"type": "PACKAGE",
"url": "https://github.com/asymmetric-effort/specifyjs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction"
}
GHSA-2988-FJ4Q-FRXV
Vulnerability from github – Published: 2025-05-26 15:30 – Updated: 2025-05-26 15:30A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
{
"affected": [],
"aliases": [
"CVE-2025-5186"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-26T13:15:20Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in thinkgem JeeSite up to 5.11.1. It has been rated as critical. Affected by this issue is the function ResourceLoader.getResource of the file /cms/fileTemplate/form of the component URI Scheme Handler. The manipulation of the argument Name leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-2988-fj4q-frxv",
"modified": "2025-05-26T15:30:34Z",
"published": "2025-05-26T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5186"
},
{
"type": "WEB",
"url": "https://github.com/xiaoyangsec/JeeSite_SSRF/blob/main/jeesite5-ssrf-file-read.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.310274"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.310274"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.581704"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2997-6FQ4-WWCH
Vulnerability from github – Published: 2022-09-29 00:00 – Updated: 2022-09-29 00:00IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
{
"affected": [],
"aliases": [
"CVE-2022-35282"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-28T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.",
"id": "GHSA-2997-6fq4-wwch",
"modified": "2022-09-29T00:00:21Z",
"published": "2022-09-29T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35282"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/230809"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6824179"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-29F2-R2FR-HJV6
Vulnerability from github – Published: 2026-06-29 09:30 – Updated: 2026-06-29 09:30A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The patch is named 487a9b980f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a patch.
{
"affected": [],
"aliases": [
"CVE-2026-13540"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-29T07:16:24Z",
"severity": "LOW"
},
"details": "A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The patch is named 487a9b980f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a patch.",
"id": "GHSA-29f2-r2fr-hjv6",
"modified": "2026-06-29T09:30:28Z",
"published": "2026-06-29T09:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13540"
},
{
"type": "WEB",
"url": "https://github.com/gitbucket/gitbucket/issues/4044"
},
{
"type": "WEB",
"url": "https://github.com/gitbucket/gitbucket/pull/4056"
},
{
"type": "WEB",
"url": "https://github.com/gitbucket/gitbucket/commit/487a9b980f56aa73b6a044b1e86a92eed5043215"
},
{
"type": "WEB",
"url": "https://github.com/gitbucket/gitbucket"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-13540"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/836108"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/374548"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/374548/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-29JH-8CFQ-RR8X
Vulnerability from github – Published: 2026-06-18 13:01 – Updated: 2026-06-18 13:01Summary
A Server-Side Request Forgery (SSRF) vulnerability was discovered in Zitadel affecting:
- HTTP Notification Channels: Used as an alternative to SMTP/Twilio configurations, sending payloads to user-defined URLs via HTTP POST webhooks.
- OIDC BackChannel Logout: Terminates sessions across different applications. When a session ends, the Zitadel server sends an HTTP POST request to configured endpoints.
- SAML Metadata URL Fetches: Fetches SAML metadata configurations from user-provided external URLs.
User-defined URLs in these components were not properly validated against an internal denylist, allowing potentially malicious URLs to bypass restrictions. Furthermore, the existing denylist mechanism previously introduced for Actions was found to be vulnerable to DNS rebinding, HTTP redirects, and protocol downgrades (HTTPS to HTTP), and it missed several common local network default entries.
Because an attacker can supply arbitrary URLs—including loopback addresses, internal IPs, or cloud link-local addresses—they could potentially gather internal network architecture details, scan internal ports, or interact with unauthorized internal services and infrastructure.
Impact
When a user-supplied URL points to a local host or internal IP address, an adversary can perform a Server-Side Request Forgery (SSRF) attack. This allows them to map internal network structures and exploit exposed internal services.
By leveraging DNS rebinding, an attacker could also bypass standard DNS-level checks, creating Time-of-Check to Time-of-Use (TOCTOU) gaps to access restricted internal endpoints. Additionally, vulnerabilities to HTTP redirects and protocol downgrades could allow attackers to manipulate the request flow or intercept sensitive communication.
Notably, if Zitadel is deployed within cloud environments (such as AWS, GCP, or Azure) that still permit legacy IMDSv1 or unauthenticated cloud metadata endpoints (169.254.169.254), an attacker could theoretically attempt to target these metadata services.
While Zitadel expects specific schemas or response formats for these features (which inherently limits data exfiltration capabilities and reduces the severe execution of the threat vector), users are strongly advised to patch immediately.
Affected Versions
Systems running one of the following versions are affected:
- 4.x:
4.0.0through4.15.1(including RC versions) - 3.x:
3.0.0through3.4.11(including RC versions)
Patches
The vulnerability has been addressed in the latest releases. The patch resolves the issue by securely validating target URLs against a hardened denylist. By default, localhost, loopback IPs, and standard internal network blocks are denied.
Note on Backports: This fix was only released on v4.x. While some of the affected components were generally available (GA), backporting the security fix to v3.x was not feasible due to the extensive code refactoring required to implement the unified network client securely. Please check the workarounds section if an upgrade to v4.x is not immediately possible.
Workarounds
The recommended solution is to update Zitadel to a patched version.
If an immediate upgrade is not possible, you can mitigate the risk by implementing strict network policies, egress firewalls, or reverse proxy rules within your infrastructure to block Zitadel from initiating outbound connections to your internal network, loopback interfaces, or cloud metadata endpoints. Note that managing these network controls is outside the scope of Zitadel's native configurations.
Questions
If you have any questions or comments about this advisory, please email us at security@zitadel.com
Credits
Thanks to everyone who reported this or a part of the vulnerability:
- cwanglab
- wooseokdotkim
- ffulbtech
- 0xBassia
- 5ud0 from Tarmo Technologies
- alanturing881
- dungNHVhust and sondt99
- oduoke567
- DavidCarliez
- eddieran
- tikket1
- Wernerina
- morimori-dev
- vamsik2k5
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55671"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T13:01:25Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability was discovered in Zitadel affecting:\n\n* **HTTP Notification Channels:** Used as an alternative to SMTP/Twilio configurations, sending payloads to user-defined URLs via HTTP POST webhooks.\n* **OIDC BackChannel Logout:** Terminates sessions across different applications. When a session ends, the Zitadel server sends an HTTP POST request to configured endpoints.\n* **SAML Metadata URL Fetches:** Fetches SAML metadata configurations from user-provided external URLs.\n\nUser-defined URLs in these components were not properly validated against an internal denylist, allowing potentially malicious URLs to bypass restrictions. Furthermore, the existing denylist mechanism previously introduced for Actions was found to be vulnerable to **DNS rebinding**, **HTTP redirects**, and **protocol downgrades (HTTPS to HTTP)**, and it missed several common local network default entries.\n\nBecause an attacker can supply arbitrary URLs\u2014including loopback addresses, internal IPs, or cloud link-local addresses\u2014they could potentially gather internal network architecture details, scan internal ports, or interact with unauthorized internal services and infrastructure.\n\n### Impact\n\nWhen a user-supplied URL points to a local host or internal IP address, an adversary can perform a Server-Side Request Forgery (SSRF) attack. This allows them to map internal network structures and exploit exposed internal services.\n\nBy leveraging DNS rebinding, an attacker could also bypass standard DNS-level checks, creating Time-of-Check to Time-of-Use (TOCTOU) gaps to access restricted internal endpoints. Additionally, vulnerabilities to HTTP redirects and protocol downgrades could allow attackers to manipulate the request flow or intercept sensitive communication.\n\nNotably, if Zitadel is deployed within cloud environments (such as AWS, GCP, or Azure) that still permit legacy IMDSv1 or unauthenticated cloud metadata endpoints (`169.254.169.254`), an attacker could theoretically attempt to target these metadata services.\n\nWhile Zitadel expects specific schemas or response formats for these features (which inherently limits data exfiltration capabilities and reduces the severe execution of the threat vector), users are strongly advised to patch immediately.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x**: `4.0.0` through `4.15.1` (including RC versions)\n* **3.x**: `3.0.0` through `3.4.11` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch resolves the issue by securely validating target URLs against a hardened denylist. By default, localhost, loopback IPs, and standard internal network blocks are denied.\n\n**Note on Backports:** This fix was only released on `v4.x`. While some of the affected components were generally available (GA), backporting the security fix to `v3.x` was not feasible due to the extensive code refactoring required to implement the unified network client securely. Please check the workarounds section if an upgrade to `v4.x` is not immediately possible.\n\n* **4.x**: Upgrade to $\\ge$[4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2)\n* **3.x**: Update to $\\ge$[v4.15.2](https://github.com/zitadel/zitadel/releases/tag/v4.15.2) or check out workarounds\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf an immediate upgrade is not possible, you can mitigate the risk by implementing strict network policies, egress firewalls, or reverse proxy rules within your infrastructure to block Zitadel from initiating outbound connections to your internal network, loopback interfaces, or cloud metadata endpoints. Note that managing these network controls is outside the scope of Zitadel\u0027s native configurations.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to everyone who reported this or a part of the vulnerability:\n\n* [cwanglab](https://github.com/cwanglab)\n* [wooseokdotkim](https://github.com/wooseokdotkim)\n* [ffulbtech](https://github.com/ffulbtech)\n* [0xBassia](https://github.com/0xBassia)\n* [5ud0](https://github.com/5ud0er) from Tarmo Technologies\n* [alanturing881](https://github.com/alanturing881)\n* [dungNHVhust](https://github.com/dungNHVhust) and [sondt99](https://github.com/sondt99)\n* [oduoke567](https://github.com/oduoke567)\n* [DavidCarliez](https://github.com/DavidCarliez)\n* [eddieran](https://github.com/eddieran)\n* [tikket1](https://github.com/tikket1)\n* [Wernerina](https://github.com/wernerina)\n* [morimori-dev](https://github.com/morimori-dev)\n* [vamsik2k5](https://github.com/vamsik2k5)",
"id": "GHSA-29jh-8cfq-rr8x",
"modified": "2026-06-18T13:01:25Z",
"published": "2026-06-18T13:01:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-29jh-8cfq-rr8x"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/commit/8e82ec1cb9a2b154ff48d3a0fa96b43d1428061f"
},
{
"type": "PACKAGE",
"url": "https://github.com/zitadel/zitadel"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v4.15.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": " ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components"
}
GHSA-29MF-95FH-HWXF
Vulnerability from github – Published: 2026-03-22 00:30 – Updated: 2026-03-22 00:30A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http_proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
{
"affected": [],
"aliases": [
"CVE-2026-4528"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-21T22:16:20Z",
"severity": "MODERATE"
},
"details": "A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http_proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.",
"id": "GHSA-29mf-95fh-hwxf",
"modified": "2026-03-22T00:30:28Z",
"published": "2026-03-22T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4528"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.352316"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.352316"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.784197"
},
{
"type": "WEB",
"url": "https://www.notion.so/Server-Side-Request-Forgery-SSRF-in-ApiFlow-329ea92a3c4180489df2fa2702078fe5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.