CVE-2026-58301: CWE-918 Server-Side Request Forgery (SSRF) in Apache Software Foundation Apache Shiro

CVE-2026-58301 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro when deployed with the Jakarta EE integration module. It allows a low-privileged user to cause the server to initiate connections to attacker-controlled URLs and transmit attacker-controlled data. This affects Apache Shiro versions 2.x through 3.0.0. The vulnerability can be mitigated by upgrading to version 3.0.1 or later or by configuring system properties to restrict the host and port for outbound connections during form resubmission.

An attacker with low privileges can abuse this vulnerability to make the server perform unauthorized network requests to attacker-controlled endpoints, potentially leading to information disclosure or other indirect impacts depending on the server's network environment and the data transmitted. The CVSS 4.0 score is 5.9 (medium severity), reflecting the moderate risk due to required privileges and user interaction.

Upgrade Apache Shiro to version 3.0.1 or later, which contains an official fix for this SSRF vulnerability. Alternatively, set the system properties 'org.apache.shiro.form-resubmit-host' and 'org.apache.shiro.form-resubmit-port' to restrict the hosts and ports that Shiro can connect to during form resubmission. No other vendor advisories or patches are provided, so check the official Apache Shiro documentation for the latest guidance.