CVE-2026-62282: OpenCVE SSRF Vulnerability

CVE-2026-62282 Overview

CVE-2026-62282 is a Server-Side Request Forgery (SSRF) vulnerability in OpenCVE, an open-source vulnerability intelligence platform. Versions prior to 3.0.0 fail to validate user-supplied HTTP or HTTPS destinations when testing Webhook and Slack notification integrations. An authenticated user with permission to configure notification channels can coerce the OpenCVE server into issuing requests to internal network resources, localhost interfaces, link-local addresses, and cloud metadata services. The attacker can also retrieve information returned by reachable HTTP services. The issue is tracked under CWE-918: Server-Side Request Forgery and fixed in OpenCVE 3.0.0.

Critical Impact
Authenticated users can pivot through OpenCVE to reach internal-only services and cloud metadata endpoints such as 169.254.169.254, potentially exposing IAM credentials and internal application data.

Affected Products

OpenCVE versions prior to 3.0.0
OpenCVE Webhook notification integration
OpenCVE Slack notification integration

Discovery Timeline

2026-09-18 - CVE-2026-62282 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-62282

Vulnerability Analysis

OpenCVE exposes a notification testing feature that lets an authenticated user validate Webhook and Slack integrations before saving them. The test workflow accepts a user-supplied URL and issues an outbound HTTP request from the OpenCVE server. Prior to version 3.0.0, the destination URL was not filtered against private, loopback, or link-local address ranges.

Because the request originates from the server, an attacker can target hosts that are unreachable from the public internet. Reachable destinations include 127.0.0.1, RFC1918 ranges, container orchestration APIs, and cloud metadata services such as http://169.254.169.254/latest/meta-data/. The response body is returned to the attacker through the notification test interface, converting the flaw into an information-disclosure primitive.

Root Cause

The notification module in web/projects/notifications.py performed HTTP requests using urllib.request without validating the target host. There was no allow-list, no DNS resolution check, and no rejection of private address space. The absence of these controls satisfies the classic SSRF pattern described in CWE-918.

Attack Vector

An authenticated user with permission to configure notifications submits a crafted URL to the Webhook or Slack test endpoint. The server resolves the hostname and issues the request with its own network identity. Responses from internal services, including cloud metadata credentials, are surfaced back to the attacker. No user interaction beyond the attacker's own session is required.

python

# Security patch in web/projects/notifications.py
# Source: https://github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0
 from datetime import datetime, timedelta
 from abc import ABC, abstractmethod
 from urllib.parse import quote
-from urllib import error as urllib_error
-from urllib import request as urllib_request
 
+import requests
 from django.conf import settings
 from django.core.mail import EmailMultiAlternatives
 from django.template.loader import render_to_string
 from django.utils import timezone
 
+from opencve.utils.ssrf import UnsafeURL, safe_request
+
 logger = logging.getLogger(__name__)
 
 DEFAULT_TRY_TIMEOUT_SEC = 30
+REDACTED_HEADER_VALUE = "[REDACTED]"
+SENSITIVE_REQUEST_HEADER_NAMES = frozenset(
+    {
+        "authorization",
+        "cookie",
+        "proxy-authorization",
+        "x-api-key",
+        "x-auth-token",
+    }
+)

The patch introduces a safe_request helper backed by validate_public_http_url and an UnsafeURL exception, and redacts sensitive request headers from logs. See the GitHub Commit Overview and Pull Request #747 for the complete diff.

Detection Methods for CVE-2026-62282

Indicators of Compromise

Outbound HTTP requests from the OpenCVE application server to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
Requests from the OpenCVE server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Webhook or Slack notification test events in application logs referencing non-standard or internal destination hostnames.
Unexpected changes to notification channel configuration by low-privilege authenticated accounts.

Detection Strategies

Inspect OpenCVE application logs for notification test invocations and correlate the target URL with allowed integration endpoints.
Monitor egress traffic from the OpenCVE host and alert on connections to private, loopback, or link-local destinations.
Baseline expected Webhook and Slack destinations, then flag deviations for review.

Monitoring Recommendations

Enable audit logging on notification configuration changes and require review for new channels.
Forward OpenCVE and reverse-proxy logs to a centralized analytics platform for retention and correlation.
Alert on any HTTP 200 responses from cloud metadata IPs originating from application workloads.

How to Mitigate CVE-2026-62282

Immediate Actions Required

Upgrade OpenCVE to version 3.0.0 or later, which introduces the opencve.utils.ssrf validation module.
Audit existing Webhook and Slack integrations for URLs pointing to internal, loopback, or metadata addresses.
Rotate any cloud IAM credentials that may have been exposed through the instance metadata service.
Restrict which user roles may create or test notification channels.

Patch Information

The fix is delivered in OpenCVE Release v3.0.0. Full remediation details are documented in GitHub Security Advisory GHSA-ch3g-4xvr-674q and tracked in Issue #743.

Workarounds

Place the OpenCVE server behind an egress proxy that denies traffic to private, loopback, and link-local ranges.
Enforce Instance Metadata Service Version 2 (IMDSv2) with hop limit 1 on AWS to block SSRF-based credential theft.
Apply network policies that restrict OpenCVE egress to known Webhook and Slack destination CIDRs.
Temporarily disable the notification testing feature for non-administrative roles until the upgrade is applied.

bash

# Example: AWS IMDSv2 enforcement to blunt metadata SSRF
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled