Executive brief
OpenCVE is a vulnerability intelligence platform that tracks and aggregates CVE data. An authenticated user with notification configuration access can trigger the system to make HTTP requests to any destination, including internal servers, localhost interfaces, and cloud metadata services. An attacker could exploit this to access sensitive information from systems that should not be reachable from the internet, potentially exposing internal service configurations, credentials, or cloud environment metadata.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the notification testing functionality for Webhook and Slack integrations. The vulnerable component insufficiently validates target URLs supplied by authenticated users, allowing requests to be sent to arbitrary HTTP(S) endpoints including internal network ranges, localhost interfaces (127.0.0.1), link-local addresses, and cloud metadata services. The attack requires authentication and notification channel configuration privileges. An attacker can interact with internal services and retrieve information from any HTTP-based service reachable from the OpenCVE server. The vulnerability has been patched in version 3.0.0 with improved URL validation that blocks requests to non-public destinations.
Affected products
- OpenCVE OpenCVE before 3.0.0
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in version 3.0.0