VulnerabilityPublished 5 Nov 2026

CVE-2026-81828: Apache OFBiz · Server-Side Request Forgery

Affects Apache OFBizSource CVE Database V5

Compare

Not known to be exploited : upgrade to 24.09.08 soon.

Data as of 5 Nov 2026, 15:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in 24.09.08

Exploitation evidence

Disclosed: evidence found.
CVE published 5 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Apache OFBiz to 24.09.08.

Affected software

Product	Affected	Fixed in
Apache Software FoundationApache OFBiz	Affected <24.09.08	Fixed in 24.09.08

AI-suggested

Users should upgrade Apache OFBiz to version 24.09.08 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated in the advisory.

Description

CVE-2026-81828 is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz versions before 24.09.08. It allows an authenticated back-office user with catalog permission to specify arbitrary URLs as a product-store survey's template location. This causes the server to fetch and render attacker-controlled content, including internal network resources and local files, without validating the URL scheme or host. The malicious content is then rendered into the HTTP response for any shopper loading the affected survey, resulting in non-blind information disclosure. The issue is fixed in version 24.09.08.

Impact

An attacker with authenticated back-office access and catalog permission can cause the server to fetch and render arbitrary URLs, including internal network and local file resources. This can lead to disclosure of sensitive internal information to external users viewing the affected product-store survey. The disclosure is non-blind, meaning the attacker can directly observe the rendered content. This could facilitate further attacks or information gathering within the internal network or cloud environment.

Summary

This vulnerability exists in the SurveyWrapper component of Apache OFBiz 24.09 prior to 24.09.08. An authenticated user with catalog permission can exploit the lack of scheme and host validation in SurveyWrapper.getTemplate by setting an arbitrary URL as the survey template location. The server fetches the content from this URL using URL.openStream() and compiles it as a FreeMarker template, which is then rendered in the HTTP response to shoppers. Unlike other widget location-loaders in OFBiz, SurveyWrapper does not validate the resolved location, enabling SSRF attacks that can access internal network endpoints, cloud metadata services, or local files via file:// URLs. The vulnerability is resolved in version 24.09.08.

CWE-918Server-Side Request Forgery (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Implementation · Operation
If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation.
Implementation · Operation
If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
DOM based XSS Prevention (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.6.1 (opens in a new tab)
V5.2.6 (opens in a new tab)
Attack patterns
Server Side Request Forgery (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 15:18 UTC

WeaknessesCWE-918

Technical details

References

Community reviews

Related threats