Executive brief
OpenBankProject OBP-API is an open-source banking API platform that uses Redis caching with Kryo serialization to store and retrieve frequently accessed data. A deserialization vulnerability in the Kryo handler allows remote attackers with access to the Redis cache to inject malicious serialized objects, potentially leading to arbitrary code execution on the API server if the cache infrastructure is compromised or exposed.
Technical details
The vulnerability exists in the KryoInjection.invert function within the Kryo Handler component (obp-api/src/main/scala/code/api/cache/Redis.scala) where unsafe deserialization of cached values occurs without proper validation or sanitization. The attack vector is network-based and requires high complexity to exploit, as an attacker must either have write access to the Redis cache or manipulate cache entries before deserialization. The vulnerability is classified as CWE-502 (deserialization of untrusted data) and could lead to remote code execution if an attacker can control the serialized data stored in Redis. The project was notified through a GitHub issue but has not yet released a patch or responded to the report.
Affected products
- OpenBankProject OBP-API up to 1.10.1
Timeline
- 2026-08-17: disclosed: Issue reported on GitHub
- 2026-09-15: advisory: CVE-2026-91842 published