Executive brief
Boruta is an Elixir-based library used to implement OAuth and OpenID Connect authorization servers. A security flaw allows unauthenticated attackers to trick the server into making unauthorized network requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal configuration data or allow attackers to interact with private services that are not intended to be accessible from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Boruta due to insufficient validation of user-supplied URIs in three code paths: OAuth 'request_uri' fetching, OpenID Connect dynamic client registration 'jwks_uri' parsing, and JWK refreshing. The vulnerable components in 'lib/boruta/oauth/request/base.ex', 'lib/boruta/openid.ex', and 'lib/boruta/adapters/ecto/clients.ex' dereference URIs using the Finch HTTP client without enforcing HTTPS, host allowlists, or restricting access to loopback and private IP ranges. An unauthenticated remote attacker can exploit this to scan internal networks or access cloud metadata endpoints (e.g., 169.254.169.254). The issue is fixed in version 2.3.7 by pinning outbound requests to trusted authorities.
Affected products
- malach-it boruta from 2.3.2 before 2.3.7
Timeline
- 2026-07-30: advisory: GHSA-5q9h-vf5j-fr2g published
- 2026-07-30: patched: Fixed in version 2.3.7 via commits 001e3dc and 95fb10b
References
- https://repo.hex.pm/
- https://github.com/
- https://cna.erlef.org/cves/CVE-2026-54885.html
- https://github.com/malach-it/boruta_auth/commit/001e3dc5c259e67c6f907e98867eda4141c96d0d
- https://github.com/malach-it/boruta_auth/commit/95fb10b78129355e475681f324c9a01ef0af2be5
- https://github.com/malach-it/boruta_auth/security/advisories/GHSA-5q9h-vf5j-fr2g