Is CVE-2026-54885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54885 being exploited in the wild.

How severe is CVE-2026-54885?

Informational severity, with a CVSS score of 6.9, published 30 July 2026.

Which products and versions are affected?

Malach-It Boruta from 2.3.2 before 2.3.7.

Is there a fix for CVE-2026-54885?

A patch was published on 2026-07-30: Fixed in version 2.3.7 via commits 001e3dc and 95fb10b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54885 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54885?

Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54885: malach-it Boruta SSRF in OAuth and OpenID URI fetching

CVE-2026-54885 · Severity: info · CVSS 6.9 · Published 2026-07-30

Boruta is an Elixir-based library used to implement OAuth and OpenID Connect authorization servers. A security flaw allows unauthenticated attackers to trick the server into making unauthorized network requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal configuration data or allow attackers to interact with private services that are not intended to be accessible from the public internet.

Technologies: Malach-It Boruta. Vendors: Malach-It.

Quick answers

Is CVE-2026-54885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54885 being exploited in the wild.
How severe is CVE-2026-54885?: Informational severity, with a CVSS score of 6.9, published 30 July 2026.
Which products and versions are affected?: Malach-It Boruta from 2.3.2 before 2.3.7.
Is there a fix for CVE-2026-54885?: A patch was published on 2026-07-30: Fixed in version 2.3.7 via commits 001e3dc and 95fb10b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54885 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54885?: Check whether you run Malach-It Boruta at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Boruta due to insufficient validation of user-supplied URIs in three code paths: OAuth 'request_uri' fetching, OpenID Connect dynamic client registration 'jwks_uri' parsing, and JWK refreshing. The vulnerable components in 'lib/boruta/oauth/request/base.ex', 'lib/boruta/openid.ex', and 'lib/boruta/adapters/ecto/clients.ex' dereference URIs using the Finch HTTP client without enforcing HTTPS, host allowlists, or restricting access to loopback and private IP ranges. An unauthenticated remote attacker can exploit this to scan internal networks or access cloud metadata endpoints (e.g., 169.254.169.254). The issue is fixed in version 2.3.7 by pinning outbound requests to trusted authorities.

Affected products

malach-it boruta from 2.3.2 before 2.3.7

Timeline

2026-07-30: advisory: GHSA-5q9h-vf5j-fr2g published
2026-07-30: patched: Fixed in version 2.3.7 via commits 001e3dc and 95fb10b

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.