CVE-2026-95634: CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
Published Oct 13, 2026
·Updated
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
4 affected components
CAI Content Credentials
Adobe C2pa Rust<0.91.1
Adobe C2pa-web Node.js<0.15.3
Adobe C2patool<0.28.1
Event History
Oct 13, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
CVE Published
via MITRE·09:27 PM
Data Sourced
via MITRE·09:27 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:19 PM
DescriptionSeverityWeaknessAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-100124
- CVE-2026-100123
- CVE-2026-104345
- CVE-2026-100122
- CVE-2026-100121
- CVE-2026-100120
- CVE-2026-100119
- CVE-2026-100118
- CVE-2026-100117
- CVE-2026-100115
- CVE-2026-100114
- CVE-2026-100139
- CVE-2026-100138
- CVE-2026-100137
- CVE-2026-106627
- CVE-2026-95632
- CVE-2026-100113
- CVE-2026-100136
- CVE-2026-100135
- CVE-2026-103296
- CVE-2026-105902
- CVE-2026-100125
- CVE-2026-100116
- CVE-2026-103294
- CVE-2026-103820
- CVE-2026-102502
- CVE-2026-102501
- CVE-2026-48377
- CVE-2026-48378
Frequently Asked Questions
1
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
2
What security impact is indicated?
The vulnerability may enable privilege escalation through SSRF. The vector indicates high confidentiality impact, no integrity impact, and no availability impact, with impact extending beyond the vulnerable component's original security authority.