# CVE-2026-11424: Altium Enterprise Server and Altium 365 SSRF in GraphQL service

Source: https://junglewise.ai/threats/cve-2026-11424-altium-enterprise-server-and-altium-365-ssrf-in-graphql-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-11424 · Severity: info · CVSS 8.3 · Published 2026-06-05

Altium Enterprise Server and Altium 365 are affected by a security flaw in their GraphQL service, which is used for data queries. An authorized user can trick the server into making requests to internal systems that are normally hidden from the public internet. This could allow an attacker to view sensitive internal configuration data or scout the company's private network for further targets.

Technologies: [Altium 365](https://junglewise.ai/threats/technologies/365). Vendors: [Altium](https://junglewise.ai/threats/vendors/altium).

## Quick answers

**Is CVE-2026-11424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11424 being exploited in the wild.

**How severe is CVE-2026-11424?** Informational severity, with a CVSS score of 8.3, published 5 June 2026.

**Which products and versions are affected?** Altium 365 All cloud instances prior to June 2026 remediation.

**Is there a fix for CVE-2026-11424?** A patch was published on 2026-06-05: Remediated in Altium 365 and fixed in Enterprise Server 8.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11424 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11424?** Check whether you run Altium 365 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in a shared GraphQL service component. The root cause is a lack of URL validation and destination filtering when the server processes user-supplied input as a URL for outbound HTTP GET requests. An authenticated attacker can exploit this to reach internal network services and cloud metadata endpoints (IMDS) that are not publicly accessible. The exploit is limited to HTTP GET requests without custom headers, but the server returns the full response body to the attacker. Altium 365 has been patched at the service level, while on-premise Enterprise Server users must update to version 8.1.1.

## Affected products

- Altium Enterprise Server versions prior to 8.1.1
- Altium 365 All cloud instances prior to June 2026 remediation

## Timeline

- 2026-06-05: disclosed
- 2026-06-05: advisory
- 2026-06-05: patched: Remediated in Altium 365 and fixed in Enterprise Server 8.1.1

## References

- [https://www.altium.com/platform/security-compliance/security-advisories](https://www.altium.com/platform/security-compliance/security-advisories)

## Related threats

- [Altium Git Service path traversal in CloneRepository action](https://junglewise.ai/threats/cve-2026-14439-altium-git-service-path-traversal-in-clonerepository-action)
- [Altium Enterprise Server and Altium 365 path traversal in Projects Service](https://junglewise.ai/threats/cve-2026-11431-altium-enterprise-server-and-altium-365-path-traversal-in)
- [Altium Enterprise Server and Altium 365 path traversal in Git Service](https://junglewise.ai/threats/cve-2026-11429-altium-enterprise-server-and-altium-365-path-traversal-in-git)