Vulnerability · Published Aug 31, 2026 · Assigned by apache
CVE-2026-58301Apache Shiro: Server-side POST request may be steered to an alternate host
Medium 5.9
In plain English
A medium-severity server-side request forgery in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2026-58301 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2026-58301 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-58301 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-58301 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-58301 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 2.0.0-alpha-0 – through 3.0.0 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:L/U:Amber