What is server-side request forgery?
Server-Side Request Forgery (SSRF) - an attack type that allows an attacker to manipulate a server into making requests to unintended or restricted resources
Azərbaycanca: Server-Side Request Forgery (SSRF) - zəifliyi olan serverin təhlükəsiz olmayan URL-lərə sorğu göndərməsinə imkan verən hücum növü
How it works
An attacker exploits a vulnerability to manipulate the server into making requests to internal or restricted resources, potentially allowing unauthorized access to sensitive data or systems.
Defense checklist5
- 01
Validate and sanitize user-supplied URLs and other request parameters
- 02
Implement whitelisting for internal or sensitive resources
- 03
Apply logging and monitoring to track server-made requests
- 04
Regularly update and patch software and security policies
- 05
Implement network segmentation and access controls
Real-world evidence
CVE-2026-17458 (mf-yang openclaw-cn), CVE-2026-16481 (googleapis/mcp-toolbox), CVE-2026-64645 (Next.js), CVE-2026-65924 (JFrog Artifactory), and CVE-2026-14869 (terraform-mcp-server) demonstrate the existence of SSRF vulnerabilities in various software applications.
Sources
- CVE-2026-17458: A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clnvd
- CVE-2026-16481: A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in tnvd
- CVE-2026-64645: Next.js is a React framework for building full-stack web applications. In versions 12.0.0nvd
- CVE-2026-65924: JFrog Artifactory support for Terraform remote repositories was found to be susceptible tonvd
- CVE-2026-64649: Next.js is a React framework for building full-stack web applications. In versions 14.1.1nvd
- CVE-2026-14869: The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgenvd
- CVE-2026-4912: The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Sidenvd
- CVE-2026-54691: datamodel-code-generator generates Python data models from schema definitions. From 0.9.1nvd
- CVE-2026-54690: datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspecnvd
- CVE-2026-11974: The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-suppliednvd
- CVE-2026-6089: The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticnvd
- CVE-2026-67346: Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnnvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.