CVE-2026-28329: CWE-918 Server-Side Request Forgery (SSRF) in SolarWinds SolarWinds Observability Self-Hosted

CVE-2026-28329 is a Server-Side Request Forgery (SSRF) vulnerability in SolarWinds Observability Self-Hosted. Authenticated attackers can exploit this flaw to cause the application server to initiate requests to arbitrary destinations, including attacker-controlled or internal network addresses. This could potentially allow attackers to access or interact with internal resources that are not otherwise accessible externally. The vulnerability has been assigned a CVSS v3.1 base score of 6.4, indicating medium severity. No specific affected versions or patch availability information is provided in the data.

An authenticated attacker can leverage the SSRF vulnerability to make the server send requests to arbitrary destinations, which may lead to unauthorized access to internal systems or services. The impact includes limited confidentiality and integrity loss but no availability impact is indicated. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor official SolarWinds advisories for updates. Until a fix is available, restrict authenticated user privileges and limit network access where possible to reduce risk.