CVE-2026-95634: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe Content Credentials Rust SDK

Adobe Content Credentials Rust SDK is affected by a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-95634. This vulnerability allows an attacker to induce the server to make unintended requests, potentially leading to privilege escalation. The issue does not require any user interaction to be exploited, and it changes the security scope, indicating that the impact extends beyond the initially vulnerable component. The CVSS 3.1 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact but no integrity or availability impact.

Successful exploitation of this SSRF vulnerability could allow an attacker to escalate privileges on the affected system, potentially gaining unauthorized access to sensitive information or system functions. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability does not require user interaction and can be exploited remotely over the network.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor Adobe's advisories for updates and consider implementing network-level protections to restrict unexpected outbound requests from the affected SDK if feasible.