Quick answers
- Is CVE-2026-32553 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32553 being exploited in the wild.
- How severe is CVE-2026-32553?
- High severity, with a CVSS score of 7.2, published 18 August 2026.
- Which products and versions are affected?
- Brainstorm Force OttoKit <=1.1.35.
- Is there a fix for CVE-2026-32553?
- A patch was published on 2026-08-14: Patch released in version 1.1.36 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-32553 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-32553?
- Check whether you run Brainstorm Force OttoKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a classic Server-Side Request Forgery (SSRF) flaw in OttoKit versions 1.1.35 and earlier that allows unauthenticated attackers to craft malicious requests. The flaw permits attackers to make the server perform outbound connections to arbitrary internal or external systems, bypassing network access controls. This can be leveraged to probe internal services, exfiltrate data, or attack internal systems that are not directly accessible from the internet. The vulnerability requires no authentication and is network-reachable. A patch is available in version 1.1.36 and later.
Affected products
- Brainstorm Force OttoKit <=1.1.35
Timeline
- 2026-08-18: disclosed: CVE published
- 2026-08-14: other: Vulnerability reported to Patchstack
- 2026-08-14: patched: Patch released in version 1.1.36