CVE-2026-55414: NL Portal Backend Libraries SSRF in form resolver

CVE-2026-55414 · Severity: medium · CVSS 5.3 · Published 2026-10-15

The NL Portal backend libraries contain a vulnerability where certain public web services for retrieving form definitions do not properly validate user-supplied web addresses. An unauthenticated attacker can trick the system into sending a privileged security token to a different location on the same server. While the impact is limited to the same server host, it could potentially lead to the exposure of sensitive internal access tokens if the server hosts other attacker-accessible services.

Technologies: NL Portal Backend Libraries. Vendors: Maven, NL Portal.

Quick answers

Is CVE-2026-55414 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55414 being exploited in the wild.
How severe is CVE-2026-55414?
Medium severity, with a CVSS score of 5.3, published 15 October 2026.
Which products and versions are affected?
nl.nl-portal:form (Maven) >= 1.1.0, < 3.0.4, ECOSYSTEM:introduced=1.1.0,fixed=3.0.4; NL Portal Backend Libraries >= 1.1.0, < 3.0.4.
Is there a fix for CVE-2026-55414?
Yes. nl.nl-portal:form (Maven): upgrade to 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55414 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55414?
Check whether you run nl.nl-portal:form (Maven) or NL Portal Backend Libraries at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nl.nl-portal:form (Maven): upgrade to 3.0.4 or later
    # set nl.nl-portal:form to 3.0.4 in your pom.xml or build.gradle

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the GraphQL resolvers `getFormDefinitionByObjectenApiUrl` and `getFormDefinitionById`. These resolvers are unauthenticated by design but fail to properly validate the `url` argument before fetching it using a privileged Objecten-API token. While a host-equality guard exists, it lacks checks for scheme, port, or path, allowing an attacker to redirect the request (and the attached Authorization header) to any endpoint on the configured Objecten-API host. The vulnerability is mitigated by the fact that the token is only sent to the configured host and responses are strictly deserialized into specific form-definition types, preventing arbitrary data exfiltration. The issue was fixed in version 3.0.4 by removing the vulnerable resolvers and implementing UUID-based lookups.

Affected products

  • NL Portal nl-portal-backend-libraries >= 1.1.0, < 3.0.4

Identifiers

  • CVE-2026-55414
  • GHSA-xm3x-9cfw-jhx4

Timeline

  • 2023-10-31: other: Vulnerability first shipped in 1.1.0.RELEASE
  • 2026-06-18: advisory: GitHub Advisory published
  • 2026-06-19: disclosed: CVE-2026-55414 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.