CVE-2026-28329: SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Observability Self-Hostedto a version that resolves this vulnerability.Fixed in 2026.4
Event History
Frequently Asked Questions
Which deployments are in scope?
The affected product is SolarWinds Observability Self-Hosted. The provided information does not identify any affected or fixed version ranges.
Does exploitation require authentication?
Yes. An attacker needs authenticated access with at least low privileges; no user interaction is required.
What can an attacker cause the server to access?
The attacker can cause the application server to send requests to attacker-controlled destinations or internal destinations. The stated impact includes low confidentiality and integrity impact.