SSRF (Server-Side Request Forgery) in opencve (CVE-2026-62282)
Summary
SSRF in opencve (CVE-2026-62282). Confidential information can be exposed externally. Mitigation: upgrade to 3.0.0 or later.
Original description
The description as published by the source.
Impact
OpenCVE contains a Server-Side Request Forgery (SSRF) vulnerability in the notification testing functionality for both Webhook and Slack integrations.
An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTP(S) endpoints. Insufficient validation of target destinations allows requests to be sent to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, and cloud metadata services.
Successful exploitation could allow an attacker to interact with internal services that are not otherwise accessible from the Internet and retrieve information from HTTP-based services reachable by the OpenCVE instance.
Patches
The vulnerability has been fixed in OpenCVE version 3.0.0, users should upgrade to version 3.0.0 or later.
The fix introduces additional validation of user-supplied URLs used by the notification testing functionality and prevents requests to localhost, private network ranges, link-local addresses, cloud metadata services, and other non-public destinations.
Workarounds
Users unable to upgrade should restrict outbound network access from OpenCVE to trusted external destinations using firewall rules, network policies, or egress filtering.
Where possible, access to localhost interfaces, private network ranges, and cloud metadata services should be blocked from the OpenCVE application environment.
Disabling access to the notification testing functi…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-62282 has been found in opencve.
Confidential information can be exposed externally. CVSS score: 6.5/10.
What to do: upgrade opencve to 3.0.0 or later.
If unsure, ask your IT team or search "opencve CVE-2026-62282" on the vendor's site.
CVE-2026-62282 (opencve) — CWE-918 / CVSS v3 6.5
Attack vector: remote (network-reachable) / no user interaction
Patched: 3.0.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
SSRF (CWE-918) exists in opencve.
Check the vendor advisory for the affected versions of opencve.
Severity: Medium (CVSS 6.5/10). Confidential information can be exposed externally.
Update to 3.0.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'opencve' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'opencve' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
opencveを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade opencve to 3.0.0ステージング環境で 3.0.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package pypi.org
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com