Vulnerability · Published May 11, 2026 · Assigned by GitHub_M
CVE-2026-42860Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
High 8.5
In plain English
A high-severity server-side request forgery in edx-enterprise from openedx. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | edx-enterprise | 7.0.5 | GHSA-64cv-vxpr-j6vc |
| PyPI | edx-enterprise | 7.0.5 | PYSEC-2026-58 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openedx | edx-enterprise | >= 7.0.2, < 7.0.5 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N