CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

3,006 vulnerabilities with CWE-918
CVE-2026-55229 HIGH
Gotenberg: SSRF via LibreOffice document processing
CVSS 7.5
CVE-2026-53450 HIGH
Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
CVSS 7.4
CVE-2026-55671 LOW
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
CVE-2026-55641 HIGH
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
CVSS 8.2
CVE-2026-56676 HIGH
9router: Image prefetch DNS rebinding allows SSRF to internal services
CVSS 7.4
CVE-2026-15143 CRITICAL
Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
CVSS 9.3
CVE-2026-60091 HIGH
PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url
CVSS 7.2
CVE-2026-56261 HIGH
Crawl4AI - Server-Side Request Forgery via Webhook URLs
CVSS 8.6
CVE-2026-15378 CRITICAL
Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
CVSS 9.3
CVE-2026-12123 MEDIUM
All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter
CVSS 6.4
CVE-2026-15330 HIGH
zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
CVSS 7.3
CVE-2026-15317 MEDIUM
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
CVSS 6.3
CVE-2026-33655 HIGH
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
CVSS 7.7
CVE-2026-0285 MEDIUM
PAN-OS Management Web Interface - Authenticated Server-Side Request Forgery
CVSS 4.9
CVE-2026-59221 HIGH
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
CVSS 7.7
CVE-2026-15189 MEDIUM
aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery
CVSS 6.3
CVE-2026-44161 HIGH
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
CVSS 7.2
CVE-2026-60105 HIGH
Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass
CVSS 8.6
CVE-2026-59806 HIGH
Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
CVSS 7.4
CVE-2026-58501 MEDIUM
Zeep SSRF because Settings.forbid_external is not enforced
CVSS 5.9
CVE-2026-59702 CRITICAL
repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack
CVSS 9.3
CVE-2026-54607 HIGH
FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)
CVSS 7.7
CVE-2026-45796 MEDIUM
Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint
CVSS 6.5
CVE-2026-59707 HIGH
LocalAI - Server-Side Request Forgery via POST /models/apply
CVSS 8.6
CVE-2026-58468 MEDIUM
NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
CVSS 5.5
Details
Vulnerabilities 3,006
Links
MITRE CWE Entry Search this CWE With Exploits