CVE-2026-54735: prebid-server's request forgery vulnerability allows for possible host environment data extraction
Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.
Patches Patched in v4.4.0
Workarounds If one is unable to update, please make sure that the affected bidder adapters are disabled.
Other sources
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/prebid/prebid-server/v4to a version that resolves this vulnerability.Fixed in 4.4.0 - Upgrade
Upgrade
prebid-serverto a version that resolves this vulnerability.Fixed in 4.4.0 - Configuration
If you cannot update, disable the affected bidder adapters that interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values.
Prebid Server bidder adapters (affected) = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54735?
The severity of CVE-2026-54735 is rated as critical with a score of 10.
What type of vulnerability is CVE-2026-54735?
CVE-2026-54735 is a request forgery vulnerability that can lead to potential data extraction from the host environment.
How do I fix CVE-2026-54735?
To fix CVE-2026-54735, ensure proper input validation for user-supplied parameters to prevent malicious URL crafting.
What systems are affected by CVE-2026-54735?
CVE-2026-54735 affects various versions of the Prebid Server software, specifically from prebid.org and its repositories.
What is the impact of CVE-2026-54735 on users?
The impact of CVE-2026-54735 includes the potential exposure of sensitive data as a result of unintended HTTP requests sent to malicious destinations.