Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31974Blind SSRF on OpenProject instance via webhooks

Low 3.0

In plain English

A low-severity server-side request forgery in openproject from opf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)3.0Low

Exploit odds (30 days)0.2%top 92.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (POST /admin/settings/mail_notifications) accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists and whether the port is open. An attacker with access can use these timing and error distinctions to map internal hosts and identify which services/ports are reachable. Similarly, you can create webhooks in OpenProject and point them to arbitrary IPs, resulting in the same kind of SSRF issue which allows attackers to scan the internal network. This vulnerability is fixed in 17.2.0.

Affected products (as reported)

Vendor	Product	Versions
opf	openproject	< 17.2.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/opf/openproject/security/advisories/GHSA-9wr7-j98g-2jh3 x_refsource_CONFIRM