CVE-2026-84761: CWE-918 Server-Side Request Forgery (SSRF) in LiteSpeed Technologies LiteSpeed Cache

This vulnerability, identified as CWE-918, involves an unauthenticated SSRF flaw in LiteSpeed Cache versions up to and including 7.9. SSRF vulnerabilities enable attackers to make the affected server perform unintended requests to internal or external resources. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or official remediation level has been published yet, and no exploits are known to be active.

An unauthenticated attacker can exploit this SSRF vulnerability to cause the server to send crafted requests, potentially accessing or manipulating internal resources or data. The impact includes partial loss of confidentiality and integrity, but no impact on availability has been reported. This could lead to information disclosure or unauthorized modification of data within the scope of the affected server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations or workarounds have been provided by the vendor at this time.