CVE-2026-42858: CWE-918: Server-Side Request Forgery (SSRF) in openedx openedx-platform
CVE-2026-42858 is a Server-Side Request Forgery (SSRF) vulnerability in the Open edX Platform's openedx-platform product. It affects versions prior to commit 6fda1f120ff5a590d120ae1180185525f399c6d0. The vulnerability allows authenticated Enterprise Admin users to supply an arbitrary URL to the sync_provider_data endpoint, which is then fetched without validation, enabling requests to internal or attacker-controlled network resources. This flaw has a high severity with a CVSS score of 8.5. A patch fixing this issue has been committed. The product is a cloud service, so the vendor typically manages remediation server-side.
AI Analysis
Technical Summary
The vulnerability exists in the sync_provider_data endpoint of the SAMLProviderDataViewSet in openedx-platform. Authenticated Enterprise Admin users can provide an arbitrary URL via the metadata_url POST parameter. This URL is used directly in a requests.get() call within fetch_metadata_xml() without any validation, IP filtering, or scheme enforcement. This allows SSRF attacks, potentially targeting internal network services or cloud metadata endpoints such as AWS 169.254.169.254. The issue is fixed by specific commits (6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054).
Potential Impact
An attacker with Enterprise Admin privileges can exploit this SSRF vulnerability to make the server perform HTTP requests to internal network services or cloud metadata endpoints. This can lead to unauthorized information disclosure (confidentiality impact is high), limited integrity impact, and no direct availability impact. The vulnerability could be leveraged to access sensitive internal resources that are otherwise inaccessible externally.
Mitigation Recommendations
A patch fixing this vulnerability is available and has been committed to the openedx-platform repository. Since openedx-platform is a cloud service, the vendor typically manages remediation server-side. Users should ensure their platform is updated to a version including commit 6fda1f120ff5a590d120ae1180185525f399c6d0 or later. Check the vendor advisory or official repository for confirmation of patch deployment and further guidance.
CVE-2026-42858: CWE-918: Server-Side Request Forgery (SSRF) in openedx openedx-platform
Description
CVE-2026-42858 is a Server-Side Request Forgery (SSRF) vulnerability in the Open edX Platform's openedx-platform product. It affects versions prior to commit 6fda1f120ff5a590d120ae1180185525f399c6d0. The vulnerability allows authenticated Enterprise Admin users to supply an arbitrary URL to the sync_provider_data endpoint, which is then fetched without validation, enabling requests to internal or attacker-controlled network resources. This flaw has a high severity with a CVSS score of 8.5. A patch fixing this issue has been committed. The product is a cloud service, so the vendor typically manages remediation server-side.
CVSS v3.1
Score 8.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the sync_provider_data endpoint of the SAMLProviderDataViewSet in openedx-platform. Authenticated Enterprise Admin users can provide an arbitrary URL via the metadata_url POST parameter. This URL is used directly in a requests.get() call within fetch_metadata_xml() without any validation, IP filtering, or scheme enforcement. This allows SSRF attacks, potentially targeting internal network services or cloud metadata endpoints such as AWS 169.254.169.254. The issue is fixed by specific commits (6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054).
Potential Impact
An attacker with Enterprise Admin privileges can exploit this SSRF vulnerability to make the server perform HTTP requests to internal network services or cloud metadata endpoints. This can lead to unauthorized information disclosure (confidentiality impact is high), limited integrity impact, and no direct availability impact. The vulnerability could be leveraged to access sensitive internal resources that are otherwise inaccessible externally.
Mitigation Recommendations
A patch fixing this vulnerability is available and has been committed to the openedx-platform repository. Since openedx-platform is a cloud service, the vendor typically manages remediation server-side. Users should ensure their platform is updated to a version including commit 6fda1f120ff5a590d120ae1180185525f399c6d0 or later. Check the vendor advisory or official repository for confirmation of patch deployment and further guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-30T16:44:48.379Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a021aa3cbff5d861043038d
Added to database: 05/11/2026, 18:06:27 UTC
Last enriched: 05/19/2026, 10:55:06 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.