CVE-2026-109651: Frappe ERPNext SSRF Vulnerability

CVE-2026-109651 Overview

CVE-2026-109651 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Frappe ERPNext versions before 15.112.0 and 16.x versions before 16.23.0. The flaw exists in a configuration field that is writable by common operational roles and accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, forcing the ERPNext server to issue requests to addresses reachable only from inside the deployment's network. This behavior enables reconnaissance of internal services, cloud metadata endpoints, and other resources normally isolated from external traffic.

Critical Impact
Authenticated users with low-privilege operational roles can pivot the ERPNext server into internal networks, enabling discovery of non-public infrastructure and interaction with internal HTTP services.

Affected Products

Frappe ERPNext versions prior to 15.112.0
Frappe ERPNext 16.x versions prior to 16.23.0
Self-hosted and cloud deployments of ERPNext using the vulnerable configuration field

Discovery Timeline

2026-10-12 - CVE-2026-109651 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109651

Vulnerability Analysis

The vulnerability resides in a configuration field within Frappe ERPNext that controls an outbound request destination. The field is exposed to operational roles routinely assigned in production tenants, which lowers the barrier for abuse. ERPNext accepts the user-supplied value and uses it as a destination for server-initiated HTTP requests. No host allowlist, scheme restriction, or private address block check is applied before the request is dispatched.

An authenticated attacker who holds one of the permitted roles can submit arbitrary hostnames or IP literals. The server then performs the request from its own network position. In typical deployments, this includes access to loopback interfaces, link-local addresses such as 169.254.169.254, Kubernetes service IPs, and other internal management endpoints that are unreachable from the public internet.

Root Cause

The root cause is missing input validation on a configuration field combined with permissive role-based access on that field. The application trusts the stored value as a request destination without enforcing destination constraints such as allowlists, DNS pinning, or private-range rejection. The classification maps directly to CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires network access to the ERPNext web interface and valid credentials for a role authorized to modify the vulnerable configuration field. The attacker edits the field to point at an internal target, then triggers the workflow that causes the server to make the outbound request. The server-issued request carries ERPNext's network identity, which may bypass perimeter controls that distinguish internal from external callers.

Further technical context is available in the GitHub Security Advisory GHSA-6qcc-cw7f-328g and the VulnCheck Advisory on Frappe ERPNext.

// No verified exploitation code is available for CVE-2026-109651.
// See the GitHub Security Advisory GHSA-6qcc-cw7f-328g for technical details.

Detection Methods for CVE-2026-109651

Indicators of Compromise

Outbound HTTP requests from the ERPNext application server to RFC1918 ranges, loopback, or cloud metadata endpoints such as 169.254.169.254.
Audit log entries showing modification of the vulnerable configuration field by non-administrative operational roles.
Unexpected DNS resolutions issued by the ERPNext host for internal-only hostnames.

Detection Strategies

Review Frappe audit trails and Version doctype entries for changes to the SSRF-prone configuration field, correlating with the acting user and role.
Inspect reverse proxy and egress firewall logs for ERPNext-originated requests destined for private IP ranges or metadata services.
Baseline the normal set of outbound hosts contacted by ERPNext and alert on deviations.

Monitoring Recommendations

Forward ERPNext application logs and egress network telemetry to a centralized analytics platform for correlation.
Alert on repeated failed internal requests originating from the ERPNext service account, which can indicate reconnaissance.
Monitor role assignment changes that grant edit rights to the vulnerable configuration field.

How to Mitigate CVE-2026-109651

Immediate Actions Required

Upgrade Frappe ERPNext to version 15.112.0 or later on the 15.x branch, or to 16.23.0 or later on the 16.x branch.
Audit which roles currently hold write access to the affected configuration field and revoke permissions where not operationally required.
Review recent modifications to the configuration field and investigate any unexpected destinations.

Patch Information

Fixes are available in Frappe ERPNext 15.112.0 and 16.23.0. Deployment details and the fixed commits are referenced in the GitHub Security Advisory GHSA-6qcc-cw7f-328g.

Workarounds

Restrict egress from the ERPNext application host so that it cannot reach internal management networks, cloud metadata endpoints, or loopback-bound services.
Place ERPNext behind an outbound proxy that enforces an allowlist of permitted destination hosts and schemes.
Limit the role set that can edit the vulnerable configuration field to trusted administrators until the upgrade is applied.

bash

# Example iptables egress restriction blocking cloud metadata and private ranges
# from the ERPNext application host (adjust to your environment).
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 443 -j REJECT