CVE-2026-62282: OpenCVE: Server-Side Request Forgery (SSRF) in notifications
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCVE notification testing (Webhook and Slack integrations)to a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenCVE user who has permission to configure notification channels can exploit it. The affected notification-testing functionality applies to Webhook and Slack integrations.
What systems can the attacker reach through a vulnerable server?
The attacker can cause the OpenCVE server to make HTTP or HTTPS requests to destinations reachable from that server. This includes internal network resources, localhost interfaces, link-local addresses, and cloud metadata services.
What can an attacker obtain?
The attacker can retrieve information from reachable HTTP services through the server-side request. The provided information does not indicate that the issue allows modification of those services.
Which versions are affected and what fixes the issue?
OpenCVE versions prior to 3.0.0 are affected. The issue is fixed in OpenCVE 3.0.0.