CVE-2026-54735: Prebid Server SSRF Vulnerability

CVE-2026-54735 Overview

CVE-2026-54735 is a Server-Side Request Forgery (SSRF) vulnerability in Prebid Server, an open-source solution for running real-time advertising auctions in the cloud. Bidder adapters in versions prior to 4.4.0 interpolate user-supplied parameters into outbound request URLs without validating host and subdomain values. Attackers can craft bid request parameters that cause the server to issue requests to unintended destinations, including internal network services and sensitive server endpoints. The issue was fixed in version 4.4.0 and is tracked under CWE-918.

Critical Impact
A remote, unauthenticated attacker can coerce Prebid Server into issuing HTTP requests to arbitrary internal or external hosts, potentially exposing cloud metadata services, internal APIs, and other sensitive endpoints reachable from the server.

Affected Products

Prebid Server versions prior to 4.4.0
Bidder adapters including acuityads and adhese that interpolate host/subdomain parameters
Deployments using vulnerable adapter configurations in Go-based Prebid Server builds

Discovery Timeline

2026-07-29 - CVE-2026-54735 published to NVD
2026-07-29 - Last updated in NVD database
Fix released - Prebid Server v4.4.0 published with host/subdomain validation via pull request #4802

Technical Details for CVE-2026-54735

Vulnerability Analysis

Prebid Server acts as a server-side auction orchestrator that forwards bid requests to configured demand partners through bidder adapters. Several adapters build outbound endpoint URLs by substituting values from the incoming bid request into URL templates using macro replacement. When adapters accept host or subdomain values from client-supplied parameters without validation, the resulting request URL can point to any host reachable from the Prebid Server instance.

The vulnerability is classified as Server-Side Request Forgery [CWE-918]. Because Prebid Server typically runs inside cloud environments with access to instance metadata endpoints, internal service meshes, and private VPC resources, an attacker who controls bid request parameters can pivot the server into an SSRF proxy. Public exploitation infrastructure has not been reported and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Affected adapters passed untrusted host and subdomain values directly into URL macro expansion routines. There was no allowlist, regex validation, or canonicalization step to confirm the resulting URL matched the intended demand partner domain. The patch introduces a shared urlutil package and calls its validators from each adapter before issuing outbound requests.

Attack Vector

An attacker sends a crafted OpenRTB bid request to a public Prebid Server endpoint. The malicious payload places attacker-controlled hostnames, IP literals, or metadata service addresses (for example 169.254.169.254) into fields the adapter uses to construct its outbound URL. Prebid Server then issues an HTTP request to that destination and may return response content or timing information usable to the attacker.

// Security patch: adapters/acuityads/acuityads.go and adapters/adhese/adhese.go
// Adds validation utility import to enforce host & subdomain checks (PR #4802)
 	"github.com/prebid/prebid-server/v4/macros"
 	"github.com/prebid/prebid-server/v4/openrtb_ext"
 	"github.com/prebid/prebid-server/v4/util/jsonutil"
+	"github.com/prebid/prebid-server/v4/util/urlutil"
 )

 type AcuityAdsAdapter struct {
// Source: https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3

Detection Methods for CVE-2026-54735

Indicators of Compromise

Outbound HTTP requests from Prebid Server processes to 169.254.169.254, metadata.google.internal, or other cloud metadata endpoints
Outbound connections from the Prebid Server host to RFC1918 addresses that do not match configured demand partners
Bid request payloads containing unusual host, subdomain, or endpoint override fields with IP literals or non-adtech domains

Detection Strategies

Compare outbound destinations from Prebid Server against an allowlist of expected bidder domains and alert on deviations
Inspect application logs for adapter URL construction anomalies, especially in acuityads, adhese, and other affected adapters
Correlate spikes in 4xx/5xx responses on adapter outbound requests with source IPs sending malformed bid requests

Monitoring Recommendations

Enable egress logging at the network layer for the Prebid Server subnet and forward to a SIEM for baseline analysis
Track HTTP client metrics per adapter and alert when unique outbound hostnames exceed historical norms
Monitor cloud provider metadata service access logs where available (for example, IMDSv2 audit trails on AWS)

How to Mitigate CVE-2026-54735

Immediate Actions Required

Upgrade Prebid Server to version 4.4.0 or later, which introduces the urlutil host and subdomain validators
Audit deployed bidder adapter configurations and disable any adapters that are not actively required for auctions
Restrict Prebid Server egress at the network layer to only the domains of contracted demand partners

Patch Information

The fix is delivered in Prebid Server v4.4.0 via commit 494ac271 and pull request #4802. Additional context is available in the GitHub Security Advisory GHSA-4p3g-4hcj-wpvx.

Workarounds

Deploy an egress proxy or firewall rule that only permits outbound HTTP(S) to known bidder domains
Block Prebid Server access to cloud instance metadata endpoints such as 169.254.169.254 at the host or VPC level
Enforce IMDSv2 with hop-limit restrictions on AWS instances hosting Prebid Server to prevent metadata token theft via SSRF

bash

# Example: block instance metadata access from the Prebid Server host
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner prebid -j DROP

# Example: restrict egress to an allowlist of bidder domains via proxy
export HTTPS_PROXY=http://egress-allowlist-proxy.internal:3128