Is CVE-2026-26379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26379 being exploited in the wild.

How severe is CVE-2026-26379?

Informational severity, with a CVSS score of 0, published 3 June 2026.

Is there a fix for CVE-2026-26379?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26379 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26379?

Check whether you run Koha Community Koha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26379: Koha SSRF in Z39.50 configuration module

CVE-2026-26379 · Severity: info · CVSS 0 · Published 2026-06-03

Koha, an open-source integrated library system, contains a vulnerability in its Z39.50 configuration module. An attacker can exploit this to perform Server-Side Request Forgery (SSRF), allowing them to scan internal network services or interact with internal systems that are not normally accessible from the internet. This could lead to further internal network compromise or unauthorized data access.

Technologies: Koha Community Koha. Vendors: Koha Community.

Quick answers

Is CVE-2026-26379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26379 being exploited in the wild.
How severe is CVE-2026-26379?: Informational severity, with a CVSS score of 0, published 3 June 2026.
Which products and versions are affected?: Koha Community Koha <= 25.11.
Is there a fix for CVE-2026-26379?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26379 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26379?: Check whether you run Koha Community Koha at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Koha versions up to and including 25.11. The flaw is located in the Z39.50/SRU server configuration module, where the application fails to properly validate or restrict the host and port parameters provided by a user. By configuring a malicious Z39.50 server entry and initiating a search via 'z3950_search.pl', an attacker can force the Koha server to make outbound requests to arbitrary internal or external IP addresses and ports. While the initial NVD description mentions remote code execution, the researcher's technical write-up specifically demonstrates SSRF used for internal port scanning. Authentication is likely required to access the administration dashboard to configure the server settings.

Affected products

Koha Community Koha <= 25.11

Timeline

2025-12-31: disclosed: Researcher published technical details of SSRF vulnerability
2026-06-03: advisory: CVE-2026-26379 published by NVD/MITRE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.