CVE-2026-26338: Alfresco Transform Service SSRF Flaw

CVE-2026-26338 Overview

CVE-2026-26338 is a Server-Side Request Forgery (SSRF) vulnerability in Hyland Alfresco Transformation Service. Unauthenticated attackers can abuse the document processing functionality to coerce the service into making arbitrary outbound HTTP requests. The flaw maps to CWE-918: Server-Side Request Forgery and affects both alfresco_transform_service and alfresco_transform_core components. Hyland published a coordinated security update covering CVE-2026-26337, CVE-2026-26338, and CVE-2026-26339. The vulnerability is exploitable over the network with no privileges or user interaction.

Critical Impact
Unauthenticated remote attackers can force the Alfresco Transformation Service to issue arbitrary requests, enabling internal network reconnaissance, interaction with internal-only services, and potential exposure of cloud metadata or sensitive low-trust resources.

Affected Products

Hyland Alfresco Transform Service (all versions prior to the Hyland security update)
Hyland Alfresco Transform Core
Hyland Alfresco Transform Core 5.3.0 alpha1

Discovery Timeline

2026-02-19 - CVE-2026-26338 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-26338

Vulnerability Analysis

The Alfresco Transformation Service converts uploaded documents between formats such as PDF, image, and text. The service accepts user-controlled inputs that influence outbound network operations during document processing. Because the affected endpoints do not require authentication and do not validate destination URLs, an attacker can submit a transformation request that directs the server to fetch attacker-chosen resources. The server then performs the request from its own network position, bypassing perimeter controls that would otherwise block external clients.

SSRF in document-processing pipelines is particularly impactful because these services typically run inside trusted application tiers. From that vantage point, the service can reach internal management interfaces, databases, message brokers, and cloud instance metadata endpoints such as 169.254.169.254. The CWE-918 classification confirms the issue is a classic request forgery rather than a parser-side flaw.

Root Cause

The root cause is missing validation of URLs and resource identifiers consumed by the transformation pipeline. Inputs that should be constrained to safe, server-local document sources are instead passed to an HTTP client that resolves arbitrary hostnames and schemes. There is no allowlist, no network-egress segmentation enforced at the application layer, and no authentication gate in front of the vulnerable endpoint.

Attack Vector

The attack vector is network-based. An attacker sends a crafted transformation request to the exposed Alfresco Transformation Service API. The request includes a URL or source-reference parameter pointing to an internal resource, a cloud metadata service, or an attacker-controlled host used for blind SSRF confirmation. The service performs the outbound request and, depending on the transformation path, may return response content, error messages, or timing differences usable for inference. See the VulnCheck Hyland Alfresco SSRF Advisory for additional technical context.

No verified public proof-of-concept code is available at the time of writing. Refer to the Hyland Security Update Blog for vendor-specific exploitation details.

Detection Methods for CVE-2026-26338

Indicators of Compromise

Outbound HTTP/HTTPS connections from Alfresco Transformation Service hosts to internal RFC1918 ranges, link-local addresses such as 169.254.169.254, or unexpected external domains.
Transformation request logs containing URL parameters with non-standard schemes (file://, gopher://, dict://) or IP literals.
Spikes in failed or unusually long transformation jobs initiated by unauthenticated clients.
DNS queries from the transformation host for attacker-controlled callback domains used in blind SSRF testing.

Detection Strategies

Inspect Alfresco Transformation Service access and application logs for transformation requests containing URL-like parameters originating from unauthenticated sessions.
Correlate outbound network flows from the transformation host against an allowlist of legitimate dependencies such as the Alfresco repository and configured storage backends.
Alert on any access from the transformation service to cloud instance metadata endpoints, which it should never query during normal operation.

Monitoring Recommendations

Forward Alfresco and reverse-proxy logs to a centralized analytics platform and retain them for at least 90 days.
Enable egress flow logging on the subnets hosting the transformation service and baseline normal destinations.
Monitor for new or rare outbound destinations using anomaly detection on host-to-destination pairs.

How to Mitigate CVE-2026-26338

Immediate Actions Required

Apply the Hyland security update referenced in the Hyland Security Update Blog covering CVE-2026-26337, CVE-2026-26338, and CVE-2026-26339.
Remove direct internet exposure of the Alfresco Transformation Service and place it behind an authenticated reverse proxy.
Audit recent transformation logs for SSRF probing patterns and outbound connections to metadata or internal-only endpoints.

Patch Information

Hyland has released security updates addressing CVE-2026-26338 alongside CVE-2026-26337 and CVE-2026-26339. Administrators should consult the vendor advisory for the specific fixed versions of alfresco_transform_service and alfresco_transform_core applicable to their deployment. See the Hyland Security Update Blog for version-mapping and upgrade instructions.

Workarounds

Enforce strict egress filtering from the transformation service host, denying traffic to RFC1918 ranges, 169.254.0.0/16, and any destination outside the documented dependency list.
Require authentication at the reverse proxy or API gateway in front of the transformation service until the patch is applied.
Block protocol schemes other than http and https at the application proxy layer to limit SSRF-amplification primitives such as gopher:// and file://.
On cloud deployments, enforce IMDSv2 (or the equivalent hop-limit protection) to prevent metadata theft from forged requests.

bash

# Configuration example: restrict egress from the Alfresco Transformation Service host
# Allow only the Alfresco repository and required storage backend, deny internal ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -d <alfresco-repo-ip> -p tcp --dport 8080 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -d <storage-backend-cidr> -j ACCEPT
iptables -A OUTPUT -j REJECT