CVE-2026-44598: Apache Shiro SSRF Vulnerability

CVE-2026-44598 Overview

CVE-2026-44598 is an Open Redirect and Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro's shiro-jakarta-ee integration module. The flaw stems from the shiroSavedRequest cookie being neither validated nor encrypted after login. An authenticated attacker can forge this cookie to force the server to issue an HTTP GET request to an arbitrary URL, or to redirect users to attacker-controlled destinations. The vulnerability affects Apache Shiro versions 2.0-alpha through 2.1.0 and 3.0.0-alpha-1. Apache has assigned the issue [CWE-601] (URL Redirection to Untrusted Site).

Critical Impact
Authenticated attackers can abuse the unvalidated shiroSavedRequest cookie to perform SSRF against internal services or redirect victims to malicious sites.

Affected Products

Apache Shiro 2.0-alpha through 2.1.0 using the shiro-jakarta-ee integration module
Apache Shiro 3.0.0-alpha-1 using the shiro-jakarta-ee integration module
Applications relying on Shiro's Jakarta EE post-login redirect handling

Discovery Timeline

2026-05-25 - CVE-2026-44598 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-44598

Vulnerability Analysis

Apache Shiro is a Java security framework that handles authentication, authorization, cryptography, and session management. The shiro-jakarta-ee integration module supports the Jakarta EE platform and manages post-login navigation through a cookie named shiroSavedRequest. After a user authenticates, Shiro reads this cookie to redirect the user back to the web page they originally requested.

The module fails to validate or cryptographically protect the cookie value. An authenticated attacker can set the shiroSavedRequest cookie to an arbitrary URL. Shiro then performs two unsafe actions: it redirects the browser to the attacker-supplied URL, and the server itself can issue an HTTP GET request to that URL. This combination produces both an Open Redirect and an SSRF primitive in the same request flow.

Root Cause

The root cause is missing integrity protection on the shiroSavedRequest cookie. The cookie is stored client-side without encryption or a signed message authentication code (MAC), so the server cannot detect tampering. Apache addressed this in version 2.1.1 and 3.0.0-alpha-2 by encrypting the cookie, restoring server-side trust in its contents.

Attack Vector

Exploitation requires valid login credentials. After authenticating, the attacker overwrites the shiroSavedRequest cookie with a crafted URL pointing to an internal service, cloud metadata endpoint, or external malicious host. The next request that triggers the post-login redirect logic causes the Shiro server to issue an outbound HTTP GET to the attacker-chosen URL and to redirect the browser to the same destination. This can be used to probe internal networks, reach unauthenticated internal APIs, or stage credential-phishing pages on a trusted domain.

No verified public proof-of-concept code is available. Refer to the Apache Shiro Security Report and the OpenWall OSS Security Discussion for technical details.

Detection Methods for CVE-2026-44598

Indicators of Compromise

Inbound HTTP requests carrying a shiroSavedRequest cookie whose decoded value points to external or internal-only hostnames
Outbound HTTP GET traffic from the Shiro application server to IP ranges or domains not part of normal application behavior
Redirect responses (HTTP 302) sent to authenticated users pointing to hosts outside the application's trusted domain list

Detection Strategies

Inspect access logs for authenticated sessions whose post-login redirects resolve to URLs outside the application's allowlisted domains
Correlate authenticated session activity with outbound network connections from the application server to detect SSRF callouts
Monitor for repeated cookie value changes on shiroSavedRequest within a single session, which indicates tampering attempts

Monitoring Recommendations

Forward Shiro application logs and web server access logs to a centralized analytics platform and alert on anomalous redirect targets
Baseline outbound HTTP traffic from application servers and alert on connections to cloud metadata endpoints such as 169.254.169.254
Track Shiro library versions across the estate so deployments still running affected releases are flagged for patching

How to Mitigate CVE-2026-44598

Immediate Actions Required

Upgrade Apache Shiro to version 2.1.1 or 3.0.0-alpha-2 or later, which encrypts the shiroSavedRequest cookie
Audit applications for use of the shiro-jakarta-ee integration module to identify affected deployments
Review authenticated user activity logs for evidence of forged shiroSavedRequest cookies prior to patching

Patch Information

Apache has released fixed versions 2.1.1 and 3.0.0-alpha-2. The fix encrypts the shiroSavedRequest cookie so the server can detect tampering and reject forged values. See the Apache Shiro Security Report for upgrade guidance.

Workarounds

Restrict outbound network egress from the application server to only required destinations, blocking SSRF reach to internal services and cloud metadata endpoints
Enforce a server-side allowlist of permitted redirect targets in application code rather than trusting the cookie value
If immediate upgrade is not possible, disable use of the shiro-jakarta-ee integration module's saved-request redirect feature

bash

# Example egress restriction using iptables to block access to cloud metadata
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP