CVE-2026-48053 Overview
CVE-2026-48053 is a Server-Side Request Forgery (SSRF) vulnerability in Kolibri, an offline-first education platform maintained by Learning Equality. Multiple Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server. The server then reflects the response body back to the caller. The initial disclosure identified two endpoints in the RemoteFacilityUser* viewsets, and the remediation review uncovered two additional reflection points following the same pattern. One of the affected GET endpoints was reachable without authentication. Version 0.19.4 remediates the issue.
Critical Impact
Unauthenticated attackers can coerce Kolibri servers to issue outbound HTTP requests to arbitrary URLs and read the responses, enabling reconnaissance of internal networks and metadata services.
Affected Products
- Kolibri versions prior to 0.19.4
- RemoteFacilityUser* viewset endpoints in the Kolibri API
- Two additional reflection endpoints identified during remediation review
Discovery Timeline
- 2026-08-17 - CVE-2026-48053 published to the National Vulnerability Database
- 2026-08-17 - Last updated in NVD database
Technical Details for CVE-2026-48053
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery classified under CWE-918. Kolibri exposes API endpoints that accept a baseurl parameter intended to identify a peer Kolibri server for federation-style requests. The application uses this parameter to construct an outbound HTTP request without validating that the target host is a legitimate Kolibri peer or that it resides in an allowlisted network range.
Because the server returns the response body from the fetched URL to the API caller, attackers gain a read primitive against any host the Kolibri process can reach. This includes loopback services, private RFC1918 ranges, and cloud instance metadata endpoints. At least one affected GET endpoint required no authentication, so external actors can invoke the SSRF directly against internet-exposed Kolibri deployments.
Root Cause
The root cause is missing input validation on user-supplied URL parameters combined with response reflection. The RemoteFacilityUser* viewsets and two related endpoints trust the baseurl value as a request target. No schema, host, or network-range checks constrain the destination before the server-side HTTP client executes the request.
Attack Vector
An attacker sends a crafted request to an affected Kolibri endpoint with a baseurl parameter pointing at an internal service, a cloud metadata endpoint, or an external listener. The Kolibri server issues the outbound request using its own network position and returns the response body to the attacker. Because the vulnerable GET endpoint is unauthenticated, exploitation requires no credentials and no user interaction. Details on the specific request patterns are available in the GitHub Security Advisory GHSA-4mj9-pf4r-cqrc.
Detection Methods for CVE-2026-48053
Indicators of Compromise
- Outbound HTTP requests from the Kolibri server process to non-peer hosts, private IP ranges, or cloud metadata addresses such as 169.254.169.254.
- Access log entries showing requests to RemoteFacilityUser* endpoints containing a baseurl query parameter with unexpected schemes or hosts.
- Unusual response sizes on affected endpoints correlating with reflected upstream content.
Detection Strategies
- Review Kolibri application logs for requests to the affected viewsets and inspect the baseurl parameter values for non-allowlisted destinations.
- Correlate web server logs with egress firewall or proxy logs to identify server-initiated requests triggered by inbound API calls.
- Alert on any Kolibri-originated traffic to cloud instance metadata services or internal management interfaces.
Monitoring Recommendations
- Enable egress logging on the host running Kolibri and forward the data to a centralized analytics platform for retention and search.
- Monitor for anomalous patterns of outbound HTTP requests originating from the Kolibri service account.
- Track version fingerprints of Kolibri deployments to identify instances running versions earlier than 0.19.4.
How to Mitigate CVE-2026-48053
Immediate Actions Required
- Upgrade Kolibri to version 0.19.4 or later, available at the Kolibri v0.19.4 release page.
- Inventory internet-exposed Kolibri deployments and prioritize patching hosts reachable from untrusted networks.
- Review recent access logs on the RemoteFacilityUser* endpoints for exploitation attempts.
Patch Information
Learning Equality released Kolibri 0.19.4 with input validation on the baseurl parameter across all four identified reflection points. See the Kolibri v0.19.4 release notes and the PyPA advisory PYSEC-2026-2554 for details.
Workarounds
- Restrict Kolibri egress traffic at the network layer to only the hosts and ports required for legitimate peer synchronization.
- Block Kolibri server access to cloud instance metadata endpoints and internal management ranges using host or network firewalls.
- Place unauthenticated Kolibri endpoints behind a reverse proxy that enforces authentication or network-level allowlisting until patching is complete.
# Configuration example: restrict egress from the Kolibri host using iptables
# Block access to AWS/GCP/Azure instance metadata service
iptables -A OUTPUT -m owner --uid-owner kolibri -d 169.254.169.254 -j DROP
# Block outbound traffic to RFC1918 ranges except approved peer subnet 10.10.0.0/24
iptables -A OUTPUT -m owner --uid-owner kolibri -d 10.0.0.0/8 ! -d 10.10.0.0/24 -j DROP
iptables -A OUTPUT -m owner --uid-owner kolibri -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner kolibri -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
