CVE-2026-42858: Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint
Open edX Platform enables the authoring and delivery of online learning at any scale. The syncproviderdata endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadataurl POST parameter. This URL is passed directly to requests.get() in fetchmetadataxml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42858?
CVE-2026-42858 has been classified with a severity rating, indicating a significant risk associated with server-side request forgery (SSRF) vulnerabilities.
How do I fix CVE-2026-42858?
To mitigate CVE-2026-42858, it is recommended to update the Open edX Platform to a version released after April 24, 2026.
Who is affected by CVE-2026-42858?
Authenticated Enterprise Admin users of the Open edX Platform may be affected by CVE-2026-42858 due to improper handling in the sync_provider_data endpoint.
What could an attacker do with CVE-2026-42858?
An attacker could exploit CVE-2026-42858 to perform server-side request forgery (SSRF) attacks, potentially accessing internal services or data.
What components of Open edX are vulnerable in CVE-2026-42858?
The vulnerability CVE-2026-42858 specifically affects the sync_provider_data endpoint in the SAMLProviderDataViewSet of the Open edX Platform.