# CVE-2026-42858: Open edX Platform SSRF in SAMLProviderDataViewSet

Source: https://junglewise.ai/threats/cve-2026-42858-open-edx-platform-ssrf-in-samlproviderdataviewset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-42858 · Severity: high · CVSS 8.5 · Published 2026-05-11

Open edX is an open-source platform used to host and deliver online courses. A security flaw in the platform's SAML identity provider integration allows administrative users to force the server to make unauthorized requests to internal systems. This could allow an attacker to steal sensitive cloud credentials, scan private internal networks, or access internal services not intended for public exposure, potentially leading to a full compromise of the hosting environment.

Vendors: [Open edX](https://junglewise.ai/threats/vendors/open-edx).

## Quick answers

**Is CVE-2026-42858 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42858 being exploited in the wild.

**How severe is CVE-2026-42858?** High severity, with a CVSS score of 8.5, published 11 May 2026.

**Which products and versions are affected?** Open edX All versions containing SAMLProviderDataViewSet.sync_provider_data.

**Is there a fix for CVE-2026-42858?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42858 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42858?** Check whether you run Open edX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `sync_provider_data` endpoint within the `SAMLProviderDataViewSet`. The `metadata_url` POST parameter is passed directly to `requests.get()` in the `fetch_metadata_xml()` function without validation of the URL scheme, IP address, or destination. An authenticated attacker with Enterprise Admin privileges can exploit this to perform internal network scanning or access cloud instance metadata services (e.g., AWS 169.254.169.254). In cloud environments, this can be escalated to Remote Code Execution (RCE) by stealing IAM credentials from the metadata service. The vulnerability has been addressed in commits 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

## Affected products

- Open edX Open edX Platform All versions containing SAMLProviderDataViewSet.sync_provider_data

## Timeline

- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE-2026-42858 published to NVD

## References

- [https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0](https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0)
- [https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054](https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054)
- [https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9](https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9)