CVE-2026-55421: Open edX Platform SSRF Vulnerability

CVE-2026-55421 Overview

CVE-2026-55421 is a Server-Side Request Forgery (SSRF) vulnerability in the Open edX Platform, an open-source learning management system used to author and deliver online courses at scale. The flaw resides in a Studio video download endpoint that accepts a user-supplied files[].url value and performs a server-side fetch using requests.get(url, allow_redirects=True). The fetched bytes are returned to the caller inside a ZIP response, enabling exfiltration of internal resources reachable from the server. Redirect-following is enabled and no timeout is applied on the vulnerable fetch path. The issue is tracked under GitHub Security Advisory GHSA-fpf9-9rpr-jvrx and remediated in commit 00b7c3c.

Critical Impact
An authenticated user with high privileges can force the Open edX Studio server to fetch arbitrary internal URLs and receive the response body, exposing internal services, cloud metadata endpoints, and other network-restricted resources [CWE-918].

Affected Products

Open edX Platform (openedx-platform) versions prior to commit 00b7c3c
Studio (cms) component, specifically cms/djangoapps/contentstore/video_storage_handlers.py
Deployments exposing the Studio video download endpoint to authenticated authors

Discovery Timeline

2026-09-02 - CVE-2026-55421 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-55421

Vulnerability Analysis

The vulnerable endpoint in cms/djangoapps/contentstore/video_storage_handlers.py accepts a JSON payload containing a files[].url field supplied by the requester. The handler passes this value directly to requests.get(url, allow_redirects=True) without validating the scheme, hostname, or resolved IP address. The response body is then bundled into a ZIP archive and returned to the caller, giving the attacker a full read-back channel for internal HTTP responses.

Because allow_redirects=True is set, an attacker can supply an external URL that returns a 3xx redirect to an internal target, bypassing simple allowlist checks that only inspect the initial URL. The absence of a request timeout also permits slow-response conditions that can be leveraged for internal port scanning or resource exhaustion against the Studio worker.

Root Cause

The root cause is missing validation of a user-controlled URL before it is used in a server-side HTTP request [CWE-918]. The handler treats files[].url as trusted input and does not restrict the destination to an allowlist of storage backends or block requests to loopback, link-local, private, or cloud metadata address ranges.

Attack Vector

An authenticated user with course-authoring privileges submits a crafted request to the Studio video download endpoint. The files[].url field points at an internal service such as http://169.254.169.254/latest/meta-data/ on AWS, an internal admin panel, or a database HTTP interface. The server fetches the URL, follows any redirects, and returns the response bytes inside a ZIP file the attacker can download and inspect.

python

# Patch excerpt: cms/djangoapps/contentstore/video_storage_handlers.py
 from path import Path as path
 from pytz import UTC
 from rest_framework import status as rest_status
+from rest_framework.exceptions import ValidationError
 from rest_framework.response import Response

 from common.djangoapps.util.json_request import JsonResponse
# Source: https://github.com/openedx/openedx-platform/commit/00b7c3ce418b487c5696b064fc5033594b045e75

The patch introduces ValidationError handling in the video storage handler, which the maintainers use to reject unsafe URLs before the outbound requests.get call is executed.

Detection Methods for CVE-2026-55421

Indicators of Compromise

Studio access logs showing POST requests to the video download endpoint with files[].url values pointing at RFC1918 ranges, 127.0.0.0/8, 169.254.169.254, or non-HTTP schemes.
Outbound HTTP requests originating from the Studio (cms) worker to internal IP addresses or cloud metadata endpoints.
ZIP responses returned from the video download endpoint that contain non-video content types such as HTML, JSON, or plaintext.
Unusual spikes in latency or connection timeouts on the Studio worker consistent with SSRF-based port scanning.

Detection Strategies

Inspect reverse-proxy and application logs for requests to the Studio video handler where the supplied URL host is not on the approved storage backend allowlist.
Correlate authenticated user sessions with outbound network flows from Studio pods or hosts to detect anomalous server-initiated traffic.
Enable DNS query logging on Studio infrastructure and alert on lookups for internal-only hostnames or metadata service domains.

Monitoring Recommendations

Forward Open edX application logs and egress network telemetry into a centralized analytics platform for correlation across identity, endpoint, and network events.
Alert on any egress from Studio workers destined for cloud metadata IPs (169.254.169.254, fd00:ec2::254) or internal management subnets.
Track authoring API calls per user and flag accounts that submit large volumes of download requests with varied external URLs.

How to Mitigate CVE-2026-55421

Immediate Actions Required

Upgrade Open edX Platform to a build that includes commit 00b7c3c (see also commits 241b914 and c9831c2).
Restrict Studio authoring accounts to trusted users and audit privilege assignments, since exploitation requires high privileges.
Place an egress firewall or proxy in front of Studio workers that blocks outbound traffic to internal subnets and cloud metadata addresses.
Rotate any credentials or tokens that may have been reachable via the cloud instance metadata service during the exposure window.

Patch Information

The vulnerability is fixed in Open edX Platform commit 00b7c3c, with related changes in commits 241b914 and c9831c2. Details are published in GHSA-fpf9-9rpr-jvrx. Operators of forked or downstream distributions should backport these patches to their supported branches.

Workarounds

Disable or gate the Studio video download endpoint at the reverse proxy until the patched commit can be deployed.
Deploy an egress HTTP proxy that enforces an allowlist of approved storage domains and rejects requests to private or link-local address ranges.
Configure IMDSv2 with hop-limit 1 on AWS and equivalent metadata protections on Azure and GCP to limit the value of any successful SSRF fetch.
Add a short connect and read timeout to any outbound fetch libraries used by custom Open edX extensions to reduce SSRF-based scanning surface.

bash

# Example egress restriction using iptables on a Studio worker
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT