Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 856

Image ID Title
CVE-2026-58508 Vulnerability in Gitea migration/mirror (CVE-2026-58508)
CVE-2026-66704 SSRF (Server-Side Request Forgery) in Gutenverse Companion (CVE-2026-66704)
CVE-2026-66654 SSRF (Server-Side Request Forgery) in Vehica Core (CVE-2026-66654)
CVE-2026-73487 Code Injection in flowise (CVE-2026-73487)
CVE-2026-73297 Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8…
CVE-2026-73432 SSRF (Server-Side Request Forgery) in Vulnerability-Lookup (CVE-2026-73432)
CVE-2026-70467 SSRF (Server-Side Request Forgery) in Fortinet FortiSIEM (CVE-2026-70467)
CVE-2026-48762 SSRF (Server-Side Request Forgery) in TypeBot (CVE-2026-48762)
CVE-2026-58639 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-58639)
CVE-2026-58612 SSRF (Server-Side Request Forgery) in Microsoft PowerShell Core (CVE-2026-58612)
CVE-2026-47922 SSRF (Server-Side Request Forgery) in CAI Content Credentials (CVE-2026-47922)
CVE-2026-73087 SSRF (Server-Side Request Forgery) in github.com/amir20/dozzle (CVE-2026-73087)
CVE-2026-73082 Information Disclosure in Activepieces (CVE-2026-73082)
CVE-2026-70324 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-70324)
CVE-2026-70326 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-70326)
CVE-2026-69223 SSRF (Server-Side Request Forgery) in Apache (CVE-2026-69223)
CVE-2026-65813 SSRF (Server-Side Request Forgery) in Microsoft Exchange Server (CVE-2026-65813)
CVE-2026-48483 SSRF (Server-Side Request Forgery) in TypeBot (CVE-2026-48483)
CVE-2026-73210 A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup…
CVE-2026-51583 An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server...
CVE-2026-72784 SSRF (Server-Side Request Forgery) in Craft CMS (CVE-2026-72784)
CVE-2026-72768 SSRF (Server-Side Request Forgery) in N8N (CVE-2026-72768)
CVE-2026-72766 Vulnerability in N8N (CVE-2026-72766)
CVE-2026-50236 An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User...
CVE-2026-13739 SSRF (Server-Side Request Forgery) in Commvault (CVE-2026-13739)
CVE-2026-73160 SSRF (Server-Side Request Forgery) in Affected (CVE-2026-73160)
CVE-2026-72904 Command Injection in Firecrawl's extraction functionality (CVE-2026-72904)
CVE-2026-72761 The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses…
CVE-2026-72591 A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an...
CVE-2026-72581 A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details