CVE-2026-28301: Server-Side Request Forgery Vulnerability

CVE-2026-28301 Overview

CVE-2026-28301 is an open redirect vulnerability affecting the SolarWinds Orion Platform. An attacker can craft a malicious external URL that redirects authenticated users to an attacker-controlled website. The flaw is classified under [CWE-601] (URL Redirection to Untrusted Site).

Exploitation requires adjacent network access, low privileges, and high attack complexity. The vulnerability does not affect integrity or availability but can be leveraged in phishing campaigns to harvest credentials or deliver malicious content under the trusted context of a SolarWinds Orion deployment.

Critical Impact
Attackers can abuse trusted SolarWinds URLs to redirect operators to phishing or malware-hosting sites, enabling credential theft and follow-on intrusion against monitoring infrastructure.

Affected Products

SolarWinds Orion Platform (versions prior to HCO 2026-2)
SolarWinds Hybrid Cloud Observability deployments
SolarWinds Orion-based modules sharing the affected web component

Discovery Timeline

2026-06-09 - CVE-2026-28301 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-28301

Vulnerability Analysis

The vulnerability is an open redirect [CWE-601] in the SolarWinds Orion Platform web interface. The application accepts a user-supplied URL parameter and uses it as a redirection target without validating that the destination belongs to a trusted domain.

An attacker crafts a link that appears to originate from a legitimate SolarWinds host. When a logged-in user clicks the link, the Orion web application processes the redirect and sends the browser to an external domain controlled by the attacker. The trust placed in the SolarWinds hostname improves the success rate of phishing lures aimed at network and infrastructure operators.

Exploitation requires the attacker to reach the Orion web interface from an adjacent network position and to possess low-level credentials. While confidentiality impact is rated high due to potential credential harvesting on the spoofed destination, integrity and availability of the Orion platform itself are not directly affected.

Root Cause

The root cause is insufficient validation of redirect targets. The application treats the externally supplied URL parameter as trusted input and issues an HTTP redirect without enforcing an allow-list of internal destinations or validating the URL scheme and host.

Attack Vector

The attack vector is adjacent network. An authenticated attacker with low privileges sends a crafted URL to a legitimate Orion user through email, chat, or another channel. The URL points to the Orion server and includes a redirect parameter referencing the attacker's domain. When the victim follows the link, the Orion server returns a redirect that lands the browser on the attacker's site, where credential phishing or malware delivery can occur. See the SolarWinds Security Advisory CVE-2026-28301 for additional technical detail.

Detection Methods for CVE-2026-28301

Indicators of Compromise

Orion web server access logs showing HTTP 3xx responses with Location headers pointing to external, non-SolarWinds domains
Inbound requests to Orion endpoints containing URL parameters with fully qualified external URLs as values
User reports of unexpected redirects from internal SolarWinds links to external login pages
Outbound user traffic from Orion-referrer sessions to newly registered or low-reputation domains

Detection Strategies

Review IIS or reverse proxy logs for Orion requests that contain URL-encoded http:// or https:// values in query parameters
Correlate Orion authentication events with subsequent browser navigation to external domains via web proxy logs
Implement URL filtering rules that flag redirects originating from SolarWinds hosts to uncategorized destinations

Monitoring Recommendations

Forward Orion web server and proxy logs to a centralized analytics platform for redirect anomaly detection
Alert on first-seen external redirect targets from Orion-hosted URLs over a rolling 30-day window
Monitor email and collaboration platforms for inbound links referencing the Orion server with embedded redirect parameters

How to Mitigate CVE-2026-28301

Immediate Actions Required

Upgrade to SolarWinds Hybrid Cloud Observability 2026-2 or later as documented in the HCO 2026-2 Release Notes
Apply hardening steps from the SolarWinds Secure Configuration Guide
Restrict access to the Orion web interface to trusted management networks only
Educate Orion operators on inspecting URLs before clicking, especially links containing redirect parameters

Patch Information

SolarWinds addressed CVE-2026-28301 in the HCO 2026-2 release. Administrators should review the SolarWinds Security Advisory CVE-2026-28301 and apply the corresponding update to all Orion Platform instances. Verify the upgrade across all primary, additional, and high-availability pollers.

Workarounds

Place the Orion web interface behind a reverse proxy that strips or validates redirect parameters against an internal allow-list
Enforce web proxy policies that block redirects from Orion hosts to external domains
Limit Orion user accounts and disable interactive sessions for service accounts that do not require web access

bash

# Example reverse proxy rule to block external redirect parameters
# NGINX configuration snippet for the Orion upstream
location / {
    if ($arg_returnurl ~* "^https?://(?!orion\.internal\.example\.com)") {
        return 403;
    }
    proxy_pass https://orion-backend;
}