CVE-2026-58301: Apache Shiro: Server-side POST request may be steered to an alternate host
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.
Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the org.apache.shiro.form-resubmit-host (String) and org.apache.shiro.form-resubmit-port (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 3.0.1 - Configuration
Set the system property org.apache.shiro.form-resubmit-host to restrict the host Shiro will connect to when resubmitting a form.
Apache Shiro (Jakarta EE integration module) org.apache.shiro.form-resubmit-host = restrict to the intended host - Configuration
Set the system property org.apache.shiro.form-resubmit-port to restrict the port Shiro will connect to when resubmitting a form.
Apache Shiro (Jakarta EE integration module) org.apache.shiro.form-resubmit-port = restrict to the intended port
Event History
Frequently Asked Questions
Which deployments are affected?
Only Apache Shiro 2.x through 3.0.0 deployments that use the Jakarta EE integration module are affected. Deployments not using that integration module are not identified as affected.
What level of access does an attacker need?
A low-privileged user must be able to craft and submit an HTTP request to the application. Successful exploitation causes the server to connect to an attacker-controlled URL and send attacker-controlled data.
What can be done if upgrading is not immediately possible?
Set the org.apache.shiro.form-resubmit-host system property to a permitted host and org.apache.shiro.form-resubmit-port to a permitted port. These properties restrict the destination Shiro can contact when resubmitting a form.