CVE-2026-33182: Saloon PHP Library SSRF Vulnerability

CVE-2026-33182 Overview

CVE-2026-33182 is a Server-Side Request Forgery (SSRF) and credential leakage vulnerability affecting the Saloon PHP library, a popular tool for building API integrations and SDKs. Prior to version 4.0.0, the library improperly handled URL construction when combining connector base URLs with request endpoints. When an endpoint was provided as a valid absolute URL, the code used that URL as-is, completely bypassing the configured base URL. This allowed authentication headers, cookies, and tokens attached by the connector to be sent to attacker-controlled hosts.

Critical Impact

Applications using Saloon with user-controllable endpoint parameters (such as redirect_uri or callback URLs) are vulnerable to SSRF attacks and credential theft, potentially exposing sensitive API tokens and authentication credentials to malicious third parties.

Affected Products

• Saloon PHP Library versions prior to 4.0.0
• Applications using Saloon connectors with user-controllable endpoint parameters
• API integrations where redirect URIs or callback URLs can be influenced by external input

Discovery Timeline

• 2026-03-26 - CVE-2026-33182 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33182

Vulnerability Analysis

This vulnerability stems from insufficient input validation in Saloon's URL construction logic. The URLHelper::join() function, responsible for combining the connector's base URL with request-specific endpoints, failed to properly validate whether the provided endpoint was an absolute URL. When developers pass user-controlled values as endpoint parameters—common in OAuth flows, webhook configurations, or callback URL handling—an attacker can supply a fully-qualified URL to their own server.

The impact is twofold: First, the application unknowingly performs requests to attacker-controlled infrastructure (SSRF), potentially accessing internal services or bypassing network security controls. Second, any authentication credentials configured on the connector—including API keys, bearer tokens, session cookies, or custom headers—are transmitted to the malicious endpoint, resulting in credential leakage.

This vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), as the root cause allows sensitive authentication data to be transmitted to unintended recipients.

Root Cause

The vulnerability exists in the URL joining logic within Saloon's request builder. When constructing the final request URL, the library naively concatenated or selected between the base URL and endpoint without validating the endpoint's format. If the endpoint began with a valid protocol scheme (e.g., https://), the code treated it as the complete URL, discarding the connector's base URL entirely.

This design flaw assumed that endpoint values would always be relative paths, failing to account for scenarios where endpoint parameters could be derived from external user input or configuration values. The lack of validation created an implicit trust in endpoint values that attackers could exploit.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker exploits this vulnerability by manipulating input parameters that eventually become endpoint values in Saloon requests. Common attack scenarios include:

The attacker identifies an application using Saloon where user input influences request endpoints, such as OAuth redirect URIs, webhook URLs, or API callback configurations. By supplying an absolute URL pointing to their server, the attacker causes the victim application to send authenticated requests to the malicious endpoint, capturing sensitive credentials in transit.

For technical details and verified examples, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33182

Indicators of Compromise

• Outbound HTTP/HTTPS requests from application servers to unexpected external domains
• API tokens or authentication credentials appearing in logs of third-party servers
• Unusual redirect_uri or callback URL parameters containing absolute URLs in application logs
• Failed authentication attempts following credential exposure to unauthorized parties

Detection Strategies

• Monitor outbound network traffic for requests to domains outside expected API endpoints
• Implement logging of all URL parameters passed to Saloon connectors, flagging absolute URLs
• Review application logs for OAuth or callback flows with suspicious redirect_uri values
• Deploy web application firewalls (WAF) with rules to detect SSRF patterns in request parameters

Monitoring Recommendations

• Enable verbose logging for Saloon connector requests during security audits
• Set up alerts for outbound connections to IP addresses or domains not on approved allow lists
• Monitor for authentication failures that may indicate compromised credentials
• Conduct periodic code reviews focusing on user input handling in API integration code

How to Mitigate CVE-2026-33182

Immediate Actions Required

• Upgrade Saloon PHP library to version 4.0.0 or later immediately
• Audit application code for user-controllable endpoint parameters in Saloon requests
• Review logs for evidence of exploitation or credential leakage to external hosts
• Rotate any API keys, tokens, or credentials that may have been exposed

Patch Information

The vulnerability is fixed in Saloon version 4.0.0. The fix modifies URLHelper::join() to throw an InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed by the developer. This requires callers to consciously opt-in to absolute URL functionality on a per-connector or per-request basis, preventing accidental SSRF.

For detailed upgrade instructions, refer to the Saloon Upgrade Guide. The GitHub Security Advisory provides additional context on the vulnerability and remediation.

Workarounds

• Implement strict input validation to reject absolute URLs in endpoint parameters before passing to Saloon
• Use allow lists for redirect_uri and callback URL domains, rejecting values pointing to external hosts
• Deploy network-level controls to restrict outbound connections from application servers to approved destinations
• Consider implementing request signing or URL integrity checks for callback URLs in OAuth flows

# Upgrade Saloon to the patched version
composer require saloonphp/saloon:^4.0.0

# Verify the installed version
composer show saloonphp/saloon | grep versions