CVE-2026-31974: OpenProject SSRF Vulnerability

CVE-2026-31974 Overview

OpenProject, an open-source web-based project management software, contains a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 17.2.0. The vulnerability exists in the SMTP test endpoint (POST /admin/settings/mail_notifications) which accepts arbitrary host and port values. This endpoint exhibits measurable differences in response behavior depending on whether a target IP exists and whether a port is open, allowing attackers to perform internal network reconnaissance.

Additionally, the webhook creation functionality in OpenProject can be pointed to arbitrary IP addresses, resulting in a similar SSRF condition that enables attackers to scan internal network infrastructure.

Critical Impact

Authenticated attackers with administrative access can leverage timing and error distinctions to map internal hosts, identify reachable services and ports, and potentially pivot to attack internal systems not directly accessible from the internet.

Affected Products

• OpenProject versions prior to 17.2.0
• OpenProject installations with SMTP test functionality enabled
• OpenProject deployments using webhook integrations

Discovery Timeline

• 2026-03-11 - CVE-2026-31974 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31974

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The SSRF condition allows an authenticated attacker with administrative privileges to abuse server-side functionality to make requests to internal or external resources. The attack requires network access and high-privilege authentication, with the scope extending beyond the vulnerable component to affect confidentiality of connected systems.

The vulnerability manifests in two distinct endpoints within OpenProject: the SMTP mail notification test functionality and the webhook creation mechanism. Both features lack proper validation of user-supplied destination addresses, allowing attackers to specify arbitrary hosts and ports.

Root Cause

The root cause of this vulnerability is insufficient input validation and lack of destination address restrictions in the SMTP test endpoint and webhook functionality. OpenProject fails to implement proper allowlist-based filtering or internal network address blocking when processing user-supplied host and port parameters. This allows the application server to initiate outbound connections to arbitrary destinations specified by the attacker.

Attack Vector

The attack vector is network-based and requires authenticated access with administrative privileges. An attacker can exploit this vulnerability by:

1. Accessing the SMTP test endpoint at /admin/settings/mail_notifications
2. Submitting requests with arbitrary host and port combinations
3. Analyzing response timing and error messages to determine host availability and port status
4. Using the collected information to map internal network topology

Alternatively, attackers can create webhooks pointing to internal IP addresses to achieve similar reconnaissance capabilities. The timing side-channel allows inference of network topology even when direct responses are not returned.

The vulnerability does not allow data exfiltration directly but enables internal network reconnaissance which could facilitate further attacks against internal services.

Detection Methods for CVE-2026-31974

Indicators of Compromise

• Unusual outbound connection attempts from the OpenProject server to internal IP ranges (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• High volume of requests to the /admin/settings/mail_notifications endpoint with varying host/port parameters
• Webhook configurations pointing to internal IP addresses or localhost
• Administrative audit logs showing repeated SMTP test operations with different target hosts

Detection Strategies

• Monitor HTTP POST requests to /admin/settings/mail_notifications for suspicious patterns
• Implement network egress monitoring to detect unexpected outbound connections from the OpenProject server
• Review webhook configurations for internal IP address destinations
• Analyze application logs for timing anomalies in SMTP test operations

Monitoring Recommendations

• Deploy network-level monitoring to track outbound connections from the OpenProject application server
• Implement alerting on administrative actions involving SMTP configuration changes
• Enable detailed audit logging for webhook creation and modification events
• Consider implementing a Web Application Firewall (WAF) rule to detect SSRF patterns in request parameters

How to Mitigate CVE-2026-31974

Immediate Actions Required

• Upgrade OpenProject to version 17.2.0 or later immediately
• Review existing webhook configurations and remove any pointing to internal IP addresses
• Restrict access to administrative endpoints using network-level controls
• Audit administrative user accounts and remove unnecessary privileges

Patch Information

The vulnerability is addressed in OpenProject version 17.2.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network segmentation to limit outbound connectivity from the OpenProject server
• Use firewall rules to restrict the OpenProject server from initiating connections to internal network ranges
• Disable or restrict access to the SMTP test functionality at the network or application level
• Implement proxy-based egress filtering to control outbound requests from the application server

# Example: Restrict outbound connections from OpenProject server using iptables
# Block connections to private IP ranges from the OpenProject server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
# Allow only specific required outbound destinations
iptables -A OUTPUT -d <allowed_smtp_server> -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -d <allowed_smtp_server> -p tcp --dport 587 -j ACCEPT