CVE-2026-108572 Overview
CVE-2026-108572 is a Server-Side Request Forgery (SSRF) vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the CasP3ProxyValidate function within controllers/cas.go, part of the Proxy Validation component. Attackers can manipulate the pgtUrl argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability affects Casdoor versions up to 3.164.0 and 4.10.0, and is addressed in release 4.11.0. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances.
Critical Impact
Authenticated remote attackers can leverage the pgtUrl parameter to force the Casdoor server to initiate requests to internal services, enabling reconnaissance of internal networks and metadata endpoints.
Affected Products
- Casdoor versions up to and including 3.164.0
- Casdoor versions up to and including 4.10.0
- Deployments exposing the CAS Proxy Validation endpoint
Discovery Timeline
- 2026-10-11 - CVE-2026-108572 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-108572
Vulnerability Analysis
Casdoor implements the Central Authentication Service (CAS) protocol, including proxy ticket validation. The CasP3ProxyValidate handler in controllers/cas.go accepts a pgtUrl parameter that the server contacts to issue a Proxy Granting Ticket callback. The handler fetches this URL without sufficiently validating its destination, scheme, or network scope. This matches the Server-Side Request Forgery class [CWE-918]. Because Casdoor commonly runs inside trusted internal networks or cloud environments, SSRF can be used to probe internal infrastructure, access cloud instance metadata services, or interact with services bound to loopback addresses.
Root Cause
The root cause is missing allow-list validation on the pgtUrl input prior to invoking an outbound HTTP client. The function treats the parameter as a trusted callback target, delegating request issuance to the server-side HTTP stack. Attackers substitute attacker-controlled or internal destinations, and the Casdoor backend performs the request on their behalf. The upstream patch commit 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9 (and companion ada08ecd10cbf158f593dee23a8bab63efecf995) in the Casdoor repository adds restrictions to the handling of this parameter.
Attack Vector
Exploitation is network-based and requires low-privileged authenticated access to invoke the CAS proxy validation endpoint. An attacker submits a crafted request containing a pgtUrl pointing to an internal host, cloud metadata IP such as 169.254.169.254, or an attacker-controlled logging endpoint. The Casdoor server resolves and connects to the specified destination. The response may be reflected in error messages, timing differences, or logs, enabling information disclosure about internal network topology. The exploit has been publicly disclosed via the VulDB advisory.
Detection Methods for CVE-2026-108572
Indicators of Compromise
- Unexpected outbound HTTP connections from the Casdoor process to internal RFC1918 ranges, loopback, or 169.254.169.254.
- CAS proxy validation requests containing pgtUrl values pointing to non-production hostnames or private IP addresses.
- Repeated requests to /cas/*/proxyValidate or similar CAS endpoints from a single authenticated session.
Detection Strategies
- Inspect web server and reverse proxy logs for requests to CAS proxy validation routes with suspicious pgtUrl query parameters.
- Correlate inbound CAS requests with outbound connections from the Casdoor host to detect SSRF-driven callbacks.
- Deploy egress monitoring on the Casdoor server to flag connections to cloud metadata endpoints or unexpected internal services.
Monitoring Recommendations
- Enable verbose logging on the CAS controller and forward logs to a centralized analytics platform for query and alerting.
- Baseline normal outbound destinations for the Casdoor service and alert on deviations.
- Monitor cloud audit logs for metadata service access originating from the Casdoor workload identity.
How to Mitigate CVE-2026-108572
Immediate Actions Required
- Upgrade Casdoor to version 4.11.0 or later, which contains the fix from commit 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9.
- Restrict network egress from the Casdoor host to only required external destinations.
- Audit CAS proxy validation usage and disable the feature if it is not required by downstream applications.
Patch Information
The vendor fix is available in the Casdoor v4.11.0 release. The remediation is implemented in commit 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9 and companion commit ada08ecd10cbf158f593dee23a8bab63efecf995. Operators running the 3.x branch should plan migration to the patched 4.x release line.
Workarounds
- Place Casdoor behind a reverse proxy that filters or rejects pgtUrl parameters pointing to private IP ranges and metadata endpoints.
- Apply strict egress firewall rules that deny traffic from the Casdoor host to 169.254.169.254, 127.0.0.0/8, and internal management subnets.
- Rotate any credentials or tokens accessible from the Casdoor host that may have been exposed if exploitation is suspected.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
