Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 856

Image ID Title
CVE-2026-57993 SSRF (Server-Side Request Forgery) in Microsoft Edge (CVE-2026-57993)
CVE-2026-57987 SSRF (Server-Side Request Forgery) in Microsoft Edge (CVE-2026-57987)
CVE-2026-58418 SSRF (Server-Side Request Forgery) in code.gitea.io/gitea (CVE-2026-58418)
CVE-2026-22874 SSRF (Server-Side Request Forgery) in code.gitea.io/gitea (CVE-2026-22874)
CVE-2026-11397 SSRF (Server-Side Request Forgery) in WP Import Export Lite (WordPress plugin) (CVE-2026-11397)
CVE-2026-45499 SSRF (Server-Side Request Forgery) in Azure OpenAI (CVE-2026-45499)
CVE-2026-57100 SSRF (Server-Side Request Forgery) in Microsoft Entra Provisioning Service (CVE-2026-57100)
CVE-2026-59101 SSRF (Server-Side Request Forgery) in AutoBangumi (CVE-2026-59101)
CVE-2026-59095 SSRF (Server-Side Request Forgery) in LobeChat (CVE-2026-59095)
CVE-2026-55115 SSRF (Server-Side Request Forgery) in Unifi Protect (CVE-2026-55115)
CVE-2026-55113 SSRF (Server-Side Request Forgery) in Unifi Talk Application (CVE-2026-55113)
CVE-2026-54401 SSRF (Server-Side Request Forgery) in Unifi Os Server (CVE-2026-54401)
CVE-2026-57681 SSRF (Server-Side Request Forgery) in GeoDirectory (CVE-2026-57681)
CVE-2026-57348 SSRF (Server-Side Request Forgery) in Paid Member Subscriptions (CVE-2026-57348)
CVE-2026-48978 Vulnerability in oras.land/oras-go/v2 (CVE-2026-48978)
CVE-2026-49857 SSRF (Server-Side Request Forgery) in auth-fetch-mcp (CVE-2026-49857)
CVE-2026-49856 SSRF (Server-Side Request Forgery) in @jshookmcp/jshook (CVE-2026-49856)
CVE-2026-56399 SSRF (Server-Side Request Forgery) in Open WebUI (CVE-2026-56399)
CVE-2025-36324 SSRF (Server-Side Request Forgery) in IBM watsonx.data intelligence (CVE-2025-36324)
CVE-2026-10564 SSRF (Server-Side Request Forgery) in Langflow (CVE-2026-10564)
CVE-2026-10546 SSRF (Server-Side Request Forgery) in Langflow (CVE-2026-10546)
CVE-2026-13773 SSRF (Server-Side Request Forgery) in IBM WebSphere Extreme Scale (CVE-2026-13773)
CVE-2026-10129 SSRF (Server-Side Request Forgery) in Langflow (CVE-2026-10129)
CVE-2026-49478 SSRF (Server-Side Request Forgery) in github.com/sigstore/fulcio (CVE-2026-49478)
CVE-2026-48285 SSRF (Server-Side Request Forgery) in Adobe Coldfusion (CVE-2026-48285)
CVE-2026-13316 SSRF (Server-Side Request Forgery) in http_proxies_controller and (CVE-2026-13316)
CVE-2026-57947 SSRF (Server-Side Request Forgery) in Pinpoint (CVE-2026-57947)
CVE-2026-56285 SSRF (Server-Side Request Forgery) in Nitter (CVE-2026-56285)
CVE-2026-49262 Vulnerability in aimeos/pagible (CVE-2026-49262)
CVE-2026-56663 SSRF (Server-Side Request Forgery) in AutoGPT (CVE-2026-56663)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details