Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 858

Image ID Title
CVE-2026-78024 SSRF (Server-Side Request Forgery) in Dell Policy Manager For Secure Connect Gateway (CVE-2026-78024)
CVE-2026-107294 Vulnerability in pydantic-ai (CVE-2026-107294)
CVE-2026-14521 SSRF (Server-Side Request Forgery) in IBM DataPower Gateway (CVE-2026-14521)
CVE-2026-107449 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to...
CVE-2026-20362 SSRF (Server-Side Request Forgery) in Cisco Finesse (CVE-2026-20362)
CVE-2026-102255 Vulnerability in SMA1000 Appliance Work Place interface (CVE-2026-102255)
CVE-2026-96890 SSRF (Server-Side Request Forgery) in GitHub Enterprise Server (CVE-2026-96890)
CVE-2026-39728 SSRF (Server-Side Request Forgery) in Instapage Plugin (CVE-2026-39728)
CVE-2026-39719 Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4...
CVE-2026-101893 XXE (XML External Entity) in Newell Brands DYMO ID (CVE-2026-101893)
CVE-2026-95265 SSRF (Server-Side Request Forgery) in Feehi CMS (CVE-2026-95265)
CVE-2026-105689 SSRF (Server-Side Request Forgery) in Penpot (CVE-2026-105689)
CVE-2026-105682 SSRF (Server-Side Request Forgery) in ghost (CVE-2026-105682)
CVE-2026-104977 SSRF (Server-Side Request Forgery) in Plane (CVE-2026-104977)
CVE-2026-104973 SSRF (Server-Side Request Forgery) in Plane (CVE-2026-104973)
CVE-2026-92931 SSRF (Server-Side Request Forgery) in CWE-918 (CVE-2026-92931)
CVE-2026-105238 SSRF (Server-Side Request Forgery) in ChatGPTNextWeb NextChat (CVE-2026-105238)
CVE-2026-105301 SSRF (Server-Side Request Forgery) in Keycloak (CVE-2026-105301)
CVE-2026-105048 Vulnerability in Playground feature of Zilliz Attu (CVE-2026-105048)
CVE-2026-102797 SSRF (Server-Side Request Forgery) in ThemeREX Addons (CVE-2026-102797)
CVE-2026-104458 SSRF (Server-Side Request Forgery) in YesWiki (CVE-2026-104458)
CVE-2026-80464 SSRF (Server-Side Request Forgery) in Sef - AI Chatbot Platform (CVE-2026-80464)
CVE-2026-56661 SSRF (Server-Side Request Forgery) in GetSimple CMS (CVE-2026-56661)
CVE-2026-55232 SSRF (Server-Side Request Forgery) in Vvveb (CVE-2026-55232)
CVE-2026-103082 SSRF (Server-Side Request Forgery) in LA-Studio Element Kit for Elementor (CVE-2026-103082)
CVE-2026-103497 SSRF (Server-Side Request Forgery) in JetBrains YouTrack (CVE-2026-103497)
CVE-2026-102102 SSRF (Server-Side Request Forgery) in Kiteworks Email Protection Gateway (CVE-2026-102102)
CVE-2026-102103 SSRF (Server-Side Request Forgery) in Kiteworks Email Protection Gateway (CVE-2026-102103)
CVE-2026-102105 SSRF (Server-Side Request Forgery) in Kiteworks Email Protection Gateway (CVE-2026-102105)
CVE-2026-102104 SSRF (Server-Side Request Forgery) in Kiteworks Email Protection Gateway (CVE-2026-102104)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details