CVE-2026-29097: SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability combined with a Denial of Service (DoS) condition in the RSS Feed Dashlet component. Versions 7.15.1 and 8.9.3 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29097?
CVE-2026-29097 is rated as a high severity vulnerability due to its potential for server-side request forgery and denial of service.
How do I fix CVE-2026-29097?
To address CVE-2026-29097, upgrade SuiteCRM to version 7.15.1 or later, or 8.9.3 or later.
What types of attacks are possible due to CVE-2026-29097?
CVE-2026-29097 can be exploited for server-side request forgery (SSRF) and can lead to denial of service.
Which versions of SuiteCRM are affected by CVE-2026-29097?
Versions of SuiteCRM prior to 7.15.1 and 8.9.3 are affected by CVE-2026-29097.
Is there a known exploit for CVE-2026-29097?
Yes, active exploits for CVE-2026-29097 have been identified, making it critical for users to upgrade.