CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 62 of 85

CVE-2020-8226MEDIUMCVSS 5.8EG 5.8
2020-08-17
A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
CVE-2020-16248MEDIUMCVSS 5.8EG 5.8
2020-08-09
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability
CVE-2020-6282MEDIUMCVSS 5.8EG 5.8
2020-07-14
SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send a cr…
CVE-2019-6516MEDIUMCVSS 5.8EG 5.8
2019-05-14
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF.
CVE-2019-11767MEDIUMCVSS 5.8EG 5.8
2019-05-05
Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.
CVE-2018-15516MEDIUMCVSS 5.8EG 5.8
2019-01-31
The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.
CVE-2017-7200MEDIUMCVSS 5.8EG 5.8
2017-03-21
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http…
CVE-2016-4046MEDIUMCVSS 5.8EG 5.8
2016-12-15
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary h…
CVE-2026-56084MEDIUMCVSS 5.3EG 5.8
2026-10-27
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain…
CVE-2026-22772MEDIUMCVSS 5.3EG 5.8
2026-01-12
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and …
CVE-2026-21859MEDIUMCVSS 5.3EG 5.8
2026-01-08
Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /prox…
CVE-2026-33081MEDIUMCVSS 3.7EG 5.8
2026-03-20
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial …
CVE-2026-105713MEDIUMCVSS 5.7EG 5.7
2026-10-13
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2026-106032MEDIUMCVSS 5.7EG 5.7
2026-10-06
Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environ…
CVE-2026-61612MEDIUMCVSS 5.7EG 5.7
2026-09-21
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. …
CVE-2026-53509MEDIUMCVSS 5.7EG 5.7
2026-07-07
CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arb…
CVE-2026-44520MEDIUMCVSS 5.7EG 5.7
2026-05-14
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP reques…
CVE-2026-33060MEDIUMCVSS 5.7EG 5.7
2026-03-20
CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without rest…
CVE-2025-7622MEDIUMCVSS 5.7EG 5.7
2025-08-12
During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered.
CVE-2024-37895MEDIUMCVSS 5.7EG 5.7
2024-06-17
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on th…
CVE-2023-28111MEDIUMCVSS 5.7EG 5.7
2023-03-17
Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the `beta` and `tests-passed` branches, attackers are able to bypass Discourse's server-side request forgery (SSRF) protection for private IPv4 addresses by u…
CVE-2021-43959MEDIUMCVSS 5.7EG 5.7
2022-07-26
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV import…
CVE-2026-112076MEDIUMCVSS 5.6EG 5.6
2026-10-19
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler…
CVE-2026-95623MEDIUMCVSS 5.6EG 5.6
2026-09-22
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally witho…
CVE-2026-6011MEDIUMCVSS 5.6EG 5.6
2026-04-10
A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to …
CVE-2026-5618MEDIUMCVSS 5.6EG 5.6
2026-04-06
A vulnerability was detected in kalcaddle kodbox up to 1.64. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. The atta…
CVE-2026-2711MEDIUMCVSS 5.6EG 5.6
2026-02-19
A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf_proxy.py of the component URL Handler. The mani…
CVE-2026-17305MEDIUMCVSS 5.5EG 5.5
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17067MEDIUMCVSS 5.5EG 5.5
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to server-side request forgery.
CVE-2026-118989MEDIUMCVSS 5.5EG 5.5
2026-10-29
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a…
CVE-2026-116280MEDIUMCVSS 5.5EG 5.5
2026-10-26
A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/por…
CVE-2026-103497MEDIUMCVSS 5.5EG 5.5
2026-10-01
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
CVE-2026-100900MEDIUMCVSS 5.5EG 5.5
2026-09-28
A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host…
CVE-2026-12037MEDIUMCVSS 5.5EG 5.5
2026-09-25
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with ad…
CVE-2026-96259MEDIUMCVSS 5.5EG 5.5
2026-09-22
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to…
CVE-2025-24979MEDIUMCVSS 5.5EG 5.5
2026-09-09
LF Edge eKuiper: SSRF in External Service ### Summary Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make reque…
CVE-2026-84772MEDIUMCVSS 5.5EG 5.5
2026-09-02
Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.
CVE-2026-59291MEDIUMCVSS 5.5EG 5.5
2026-08-27
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
CVE-2026-79671MEDIUMCVSS 5.5EG 5.5
2026-08-25
Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-reso…
CVE-2026-63004MEDIUMCVSS 5.5EG 5.5
2026-08-21
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams,…
CVE-2026-17534MEDIUMCVSS 5.5EG 5.5
2026-07-27
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who c…
CVE-2026-16910MEDIUMCVSS 5.5EG 5.5
2026-07-24
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST …
CVE-2026-14645MEDIUMCVSS 5.5EG 5.5
2026-07-14
Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send …
CVE-2026-58468MEDIUMCVSS 5.5EG 5.5
2026-07-07
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request no…
CVE-2026-54637MEDIUMCVSS 5.5EG 5.5
2026-07-06
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through R…
CVE-2026-11397MEDIUMCVSS 5.5EG 5.5
2026-07-03
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. The plugin's URL downloader first calls wp_safe_re…
CVE-2026-47390MEDIUMCVSS 5.5EG 5.5
2026-05-29
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The tool contains a U…
CVE-2026-41177MEDIUMCVSS 5.5EG 5.5
2026-04-22
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI …
CVE-2026-41130MEDIUMCVSS 5.5EG 5.5
2026-04-22
Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. …
CVE-2026-41129MEDIUMCVSS 5.5EG 5.5
2026-04-22
Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. The exploitation requires a few permissions to be enabled in the use…

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →