Is CVE-2026-108572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108572 being exploited in the wild.

How severe is CVE-2026-108572?

Medium severity, with a CVSS score of 4.3, published 11 October 2026.

Which products and versions are affected?

Casdoor up to 3.164.0 and 4.10.0.

Is there a fix for CVE-2026-108572?

Yes: fixed in 4.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108572 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-108572?

Check whether you run Casdoor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108572: Casdoor proxy validation server-side request forgery

CVE-2026-108572 · Severity: medium · CVSS 4.3 · Published 2026-10-11

Casdoor is an open-source identity and access management (IAM) server that handles authentication and authorization for applications. A vulnerability in its CAS proxy validation component allows attackers to manipulate the pgtUrl parameter, enabling them to make the server perform arbitrary HTTP requests to internal or external systems. This could lead to information disclosure from internal services or credential theft.

Vendors: Casdoor.

Quick answers

Is CVE-2026-108572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108572 being exploited in the wild.
How severe is CVE-2026-108572?: Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?: Casdoor up to 3.164.0 and 4.10.0.
Is there a fix for CVE-2026-108572?: Yes: fixed in 4.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108572 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108572?: Check whether you run Casdoor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.11.0

Technical details

The CasP3ProxyValidate function in controllers/cas.go fails to properly validate the pgtUrl argument, allowing a server-side request forgery (SSRF) attack. An unauthenticated remote attacker can craft a malicious URL that the Casdoor server will request on their behalf, potentially bypassing network access controls or extracting sensitive data from internal systems. The vulnerability affects versions up to 3.164.0 and 4.10.0; version 4.11.0 includes the fix.

Affected products

casdoor Casdoor up to 3.164.0 and 4.10.0

Timeline

2026-10-11: disclosed
2026-09-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.