Sign in Sign up
JA · EN · FR
SecPulse

Server-Side Request Forgery

⚔️ Attack Types Related 856
slug: ssrf

Explanation

SSRFは「外部からのリクエストを、サーバーが内部ネットワークに転送してしまう」脆弱性です。 たとえば「画像URLを貼って」と言われてWebサービスがそのURLを取りに行く機能で、攻撃者が `http://169.254.169.254/` (AWSの内部メタデータURL) を入れると、AWSの認証情報が漏洩する、というのが典型例。 クラウド時代に特に危険視されている脆弱性です。
📌 Example
Capital One事件 (2019, 1億人の個人情報流出): WAFのSSRF脆弱性経由でAWS認証情報が窃取され、S3バケットから個人情報を全件取られた。

🔖 Related tags

Denial of Service8713 Cross-Site Scripting8075 SQL Injection3881 Remote Code Execution2906 Path Traversal2053 Privilege Escalation1503 Cross-Site Request Forgery1068 Authentication Bypass853 Insecure Deserialization739 Buffer Overflow77 Command Injection28 Use After Free20 Credential Leak14 Prototype Pollution7 Integer Overflow7

🛡 Vulnerabilities tagged with this 856

Image ID Title
CVE-2026-54166 SSRF (Server-Side Request Forgery) in Shelf (CVE-2026-54166)
CVE-2026-89242 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side...
CVE-2026-19486 SSRF (Server-Side Request Forgery) in Google Cloud Gemini Enterprise Agent Platform App Builder (CVE-2026-19486)
CVE-2026-81905 Vulnerability in Concrete CMS below (CVE-2026-81905)
CVE-2026-82097 SSRF (Server-Side Request Forgery) in IBM DataStage on Cloud Pak for Data (CVE-2026-82097)
CVE-2026-54054 SSRF (Server-Side Request Forgery) in Transmute (CVE-2026-54054)
CVE-2026-9667 SSRF (Server-Side Request Forgery) in IBM WebSphere Application Server (CVE-2026-9667)
CVE-2026-88056 SSRF (Server-Side Request Forgery) in @angular/platform-server (CVE-2026-88056)
CVE-2026-88892 SSRF (Server-Side Request Forgery) in OpenPanel is an analytics platform. In all (CVE-2026-88892)
CVE-2026-19233 SSRF (Server-Side Request Forgery) in CWE-918 (CVE-2026-19233)
CVE-2026-86741 Vulnerability in Snipe-IT (CVE-2026-86741)
CVE-2026-79635 SSRF (Server-Side Request Forgery) in Dell SCG (CVE-2026-79635)
CVE-2026-19733 SSRF (Server-Side Request Forgery) in Library Information and Document Automation Program (CVE-2026-19733)
CVE-2026-80123 SSRF (Server-Side Request Forgery) in Dell SCG (CVE-2026-80123)
CVE-2026-66304 SSRF (Server-Side Request Forgery) in Microsoft Skype For Business Server (CVE-2026-66304)
CVE-2026-81357 SSRF (Server-Side Request Forgery) in Visual Studio Code (CVE-2026-81357)
CVE-2026-69904 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-69904)
CVE-2026-69683 SSRF (Server-Side Request Forgery) in Microsoft Sharepoint Server (CVE-2026-69683)
CVE-2026-69361 SSRF (Server-Side Request Forgery) in Microsoft Exchange Server (CVE-2026-69361)
CVE-2026-48707 SSRF (Server-Side Request Forgery) in InstantCMS (CVE-2026-48707)
CVE-2026-86735 SSRF (Server-Side Request Forgery) in snipe-it (CVE-2026-86735)
CVE-2026-84282 Vulnerability in ONLYOFFICE ownCloud Integration plugin (CVE-2026-84282)
CVE-2026-86590 SSRF (Server-Side Request Forgery) in Eclipse Che (CVE-2026-86590)
CVE-2026-81806 SSRF (Server-Side Request Forgery) in Hide My WP Ghost (CVE-2026-81806)
CVE-2026-76971 SSRF (Server-Side Request Forgery) in SAP Manufacturing Integration (CVE-2026-76971)
CVE-2026-86539 SSRF (Server-Side Request Forgery) in knowns (CVE-2026-86539)
CVE-2026-82757 Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who…
CVE-2026-86503 SSRF (Server-Side Request Forgery) in JetBrains IntelliJ IDEA (CVE-2026-86503)
CVE-2026-86419 Information Disclosure in Affected (CVE-2026-86419)
CVE-2026-86115 Vulnerability in Sim (CVE-2026-86115)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details