CVE-2026-77738: SSRF
Published Nov 12, 2026
·Updated
A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files.
Event History
Nov 12, 2026
CVE Published
via MITRE·03:38 AM
Data Sourced
via MITRE·03:38 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must be authenticated to DSM. The vulnerability does not require user interaction and has low attack complexity.
2
What is the impact of successful exploitation?
An authenticated attacker may use the Credential API SSRF flaw to read specific files. The provided severity vector indicates low confidentiality impact, with no stated integrity or availability impact.
3
Which DSM versions need remediation?
DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Upgrade to the applicable fixed version or later.