Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-62282OpenCVE: Server-Side Request Forgery (SSRF) in notifications
Medium 6.5
In plain English
A medium-severity server-side request forgery in opencve from opencve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | opencve | 3.0.0 | GHSA-ch3g-4xvr-674q |
| PyPI | opencve | 3.0.0 | PYSEC-2026-4130 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/opencve/opencve/security/advisories/GHSA-ch3g-4xvr-674q x_refsource_CONFIRM
- https://github.com/opencve/opencve/issues/743 x_refsource_MISC
- https://github.com/opencve/opencve/pull/747 x_refsource_MISC
- https://github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0 x_refsource_MISC
- https://github.com/opencve/opencve/releases/tag/v3.0.0 x_refsource_MISC