The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-22 2026 | SSRF Guard Bypass via Full-Form IPv4-Mapped IPv6 Literal intermediate | Library advisory detailing an SSRF protection bypass vulnerability in OpenClaw's `ssrf.ts` component. Versions up to `2026.2.13` are affected by CWE-918, where full-form IPv4-mapped IPv6 literals like `0:0:0:0:0:ffff:7f00:1` bypassed loopback and private network blocking. A fix is available in versions `2026.2.14` and later, addressed by commit `c0c0e0f9aecb913e738742f73e091f2f72d39a19`. |
| 2026-04-22 2026 | Next.js Improper Middleware Redirect Handling Leads to SSRF (CVE-2025-57822) news | Library update addressing CVE-2025-57822 in Next.js Middleware, where improper handling of request headers passed to `NextResponse.next()` could lead to Server-Side Request Forgery (SSRF) in self-hosted applications. Versions v14.2.32 and v15.4.7 resolve this vulnerability by preventing sensitive headers from being reflected back in responses. Users with custom middleware in self-hosted environments should upgrade and verify `next()` function usage. |
| 2026-04-22 2026 | Craft CMS Cloud Metadata SSRF Protection Bypass via IPv6 Resolution intermediate 3 min read | Advisory detailing a bypass of Craft CMS's GraphQL SSRF protection. The vulnerability, a bypass of CVE-2025-68437 (GHSA-x27p-wfqw-hfcc), occurs because `gethostbyname()` only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, failing the blocklist comparison. This allows attackers with GraphQL schema permissions to steal AWS credentials by targeting the AWS IMDS IPv6 endpoint via crafted URLs. |
| 2026-04-22 2026 | Axios Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (CVE-2026-40175) news 2 min read | Library vulnerability CVE-2026-40175 in Axios allows unrestricted cloud metadata exfiltration via header injection. By leveraging prototype pollution in other dependencies, attackers can trick Axios into sending CRLF-injected headers, enabling request smuggling and bypassing AWS IMDSv2 for credential theft. This critical vulnerability, affecting all versions, arises from a lack of HTTP header sanitization combined with default SSRF capabilities, with potential impacts including authentication bypass and cache poisoning. |
| 2026-04-19 2026 | CVE-2025-61882 Explained: The Oracle Zero-Day Breach news 9 min read | Analysis of CVE-2025-61882, an Oracle EBS zero-day exploited by Cl0p for unauthenticated remote code execution and data theft. The attack chain involves SSRF, CRLF injection, header smuggling, unsafe XSLT processing via BI Publisher, and privilege escalation. This vulnerability, with a CVSS score of 9.8, allowed Cl0p to bypass perimeter controls and exfiltrate sensitive ERP data from numerous enterprises before Oracle released an emergency patch. |
| 2026-04-19 2026 | Oracle EBS CVE-2025-61882: Pre-auth SSRF Leads to RCE news 3 min read | Writeup detailing Oracle EBS CVE-2025-61882, a critical pre-authentication RCE vulnerability affecting versions 12.2.3 through 12.2.14. The exploit chain leverages Server-Side Request Forgery (SSRF), CRLF injection, authentication bypass, and unsafe XSLT processing to achieve unauthenticated code execution. The vulnerability, actively exploited by groups like Cl0p, allows attackers to chain SSRF with CRLF injection and path traversal to reach internal services and execute arbitrary code via malicious XSL stylesheets. → picussecurity.com |
| 2026-04-19 2026 | Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 news 4 min read | Library detailing exploitation of CVE-2025-61882, a critical Oracle E-Business Suite vulnerability, by the Cl0p threat actor for remote code execution. The entry outlines the attack workflow involving XSL payload delivery via a malicious server, Netcat listeners, and specially crafted HTTP requests to `/OA_HTML/SyncServlet` and `/OA_HTML/RF.jsp`. It also highlights a sophisticated chain involving Server-Side Request Forgery (SSRF) and Carriage Return/Line Feed (CRLF) Injection to load untrusted XSLT templates, enabling arbitrary code execution. → thehackernews.com |
| 2026-04-19 2026 | Oracle E-Business Suite Zero-Day Exploited — Google Cloud news 12 min read | Library of techniques and analysis detailing exploitation of Oracle E-Business Suite (EBS) by the CL0P extortion group. The campaign, which may have leveraged CVE-2025-61882 as a zero-day, involved mass exploitation of vulnerabilities, including Server-Side Request Forgery (SSRF), Carriage-Return Line-Feed (CRLF) injection, authentication bypass, and XSL template injection, leading to remote code execution. The analysis covers intrusion activity preceding the extortion emails, the multi-stage Java implant framework, and provides indicators of compromise for defenders. → cloud.google.com |
| 2026-04-19 2026 | Server-Side Request Forgery (SSRF) — Practical Guide beginner | Server-Side Request Forgery (SSRF) — Practical Guide |
| 2026-04-18 2026 | Funny how the more you fuck around the more you find out. Do you see an id? mess around with it can't find the private ip where the http client is running? send a nonexistent host to leak it an enum from there #bugbountytips #SSRF pic.x.com/t0HhOXupGQ intermediate | Funny how the more you fuck around, the more you find out. Do you see an id? mess around with it, can't find the private ip where the http client is running? send a nonexistent host to leak it an enum... |
| 2026-04-17 2026 | Profile picture upload SSRF Port scan Unauthenticated admin panel Mass PII disclosure. The simplest entry points often hide the biggest impact. medium.com/@sagardhoot56/ #bugbounty #hacking #ssrf #ethicalhacking #infosec intermediate | Profile picture upload → SSRF → Port scan → Unauthenticated admin panel → Mass PII disclosure. The simplest entry points often hide the biggest impact. medium.com/@sagardhoot56/… #bugbounty #hacking #... |
| 2026-04-17 2026 | Angular patches a critical 8.7 SSRF flaw in @angular/platform-server. Attackers can hijack SSR origins via URL normalization. Patch v19 v20 or v21 now! #Angular #CyberSecurity #SSRF #WebDev #InfoSec #SSR #VulnerabilityAlert securityonline.info/angular-platfo pic.x.com/8EAUEBNxnf news | Angular patches a critical 8.7 SSRF flaw in @angular/platform-server. Attackers can hijack SSR origins via URL normalization. Patch v19, v20, or v21 now! #Angular #CyberSecurity #SSRF #WebDev #InfoSec... |
| 2026-04-16 2026 | Bypassing SSRF Filters Using r3dir intermediate 4 min read | Tool for bypassing SSRF filters, r3dir, enables attackers to craft malicious requests by controlling redirection targets, response status codes, and HTTP methods. It supports CORS preflight requests for headless browsers and integrates with BurpSuite via Hackvertor tags. The service can bypass weak allowlist filters and URL scheme limitations, and can manipulate HTTP methods from POST to GET using redirect status codes like 301, 302, and 303. |
| 2026-04-16 2026 | The Limitations of Secure SSRF Patches: Advanced Bypasses advanced 18 min read | Library that analyzes Server-Side Request Forgery (SSRF) bypass techniques, demonstrating how common patches like prefix allowlisting and basic hostname validation fail against crafted payloads. It highlights vulnerabilities exemplified by the ChatGPT-Next-Web case, where naive checks for `https://trusted.com` were bypassed using `@` notation or subdomain tricks like `api.mycompany.com.evil.org`. The library emphasizes the need for defense-in-depth beyond superficial checks to prevent attackers from accessing internal networks or cloud instance metadata. |
| 2026-04-16 2026 | DNS Rebinding Attacks Against SSRF Protections intermediate 5 min read | Library for detecting and exploiting DNS rebinding vulnerabilities that bypass SSRF protections. It details how applications resolve hostnames once to validate IPs against blocklists or allowlists, and then resolve again to make the actual HTTP request. This Time-of-Check to Time-of-Use (TOCTOU) flaw allows attackers to control DNS responses, redirecting requests from public IPs to sensitive internal endpoints like AWS IMDS (169.254.169.254) or internal APIs. The library covers techniques and tools like rbndr.us and whonow for setting up controllable DNS servers with zero TTL, and discusses fixes such as resolving once and connecting directly to the IP, using egress proxies like Smokescreen, or implementing network-level controls. |
| 2026-04-16 2026 | Cloud Metadata Dictionary Useful for SSRF Testing intermediate | Cloud Metadata Dictionary Useful for SSRF Testing |
| 2026-04-16 2026 | PayloadsAllTheThings: Server Side Request Forgery beginner 7 min read Bug Bounty | Library for Server Side Request Forgery (SSRF) vulnerabilities, detailing methodologies and bypass techniques. It covers bypassing localhost via IPv6 notation, domain redirects, CIDR, rare addresses, encoded IPs, and DNS rebinding. The library highlights exploitation via URL schemes like `jar:` and `gopher://`, blind exploitation, and offers tools such as `SSRFmap`, `Gopherus`, `See-SURF`, `SSRF-Sheriff`, `surf`, `ipfuscator`, and `r3dir` for testing and exploitation. |
| 2026-04-16 2026 | Cloud SSRF Exploitation intermediate | Cloud SSRF Exploitation |
| 2026-04-16 2026 | Learning SSRF for Fun and Bounties beginner 8 min read | Library detailing Server-Side Request Forgery (SSRF) vulnerabilities, explaining exploitation techniques like blind, semi-blind, and non-blind SSRF. It covers bypass methods such as the "@" symbol, open redirects, DNS rebinding (using tools like lock.cmpxchg8b.com/rebinder.html), URL encoding, and controlled domains, as well as techniques for accessing internal systems via loopback interfaces and using response metadata for port scanning. |
| 2026-04-16 2026 | SSRF Vulnerability on Major Gaming Company (Wiz Bug Bounty) news | Writeup detailing a real-world SSRF vulnerability discovered at a major gaming company. The challenge involves exploiting a content service that fetches resources from provided URLs to access internal cloud infrastructure and sensitive credentials. Attackers aim to trick the server into making unintended requests, thereby reaching hidden internal resources and extracting a flag. → wiz.io |
| 2026-04-16 2026 | Five Bounties, One Bug: Exploiting the Same SSRF via Five Unique Techniques advanced | Five Bounties, One Bug: Exploiting the Same SSRF via Five Unique Techniques |
| 2026-04-16 2026 | CRITICAL VULNERABILITY (CVSS 10.0) in Axios JS library! CVE-2026-40175 is an SSRF flaw that can lead to RCE and full cloud compromise. PoC is public. If you use Axios update to v1.13.2 NOW! #SupplyChain #RCE #SSRF cyber.netsecops.io/articles/critisvm news | 🚨 CRITICAL VULNERABILITY (CVSS 10.0) in Axios JS library! CVE-2026-40175 is an SSRF flaw that can lead to RCE and full cloud compromise. PoC is public. If you use Axios, update to v1.13.2 NOW! 🌐 #Supp... |
| 2026-04-15 2026 | Most hunters skip SSRF because "it's hard to find." That's exactly why it pays. Look for: URL/IP params Webhooks & PDF generators Anything the server fetches The server becomes your proxy. Internal infra = your target. Hunt smarter. #BugBounty #SSRFpic.x.com/W1hHTiDo5CC beginner | Most hunters skip SSRF because "it's hard to find." That's exactly why it pays. Look for: → URL/IP params → Webhooks & PDF generators → Anything the server fetches The server becomes your proxy. Inter... |
| 2026-04-15 2026 | Inside PostHog: How SSRF a ClickHouse SQL Escaping 0day and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099 ZDI-25-097 ZDI-25-096) #PostHog #RCEChain #SSRF #SQLInjection #Zeroday mehmetince.net/inside-posthog advanced | Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain (ZDI-25-099, ZDI-25-097, ZDI-25-096) #PostHog #RCEChain #SSRF #SQLInjection #Zeroday me... |
| 2026-04-15 2026 | 6/6 Key takeaways: - Screenshot/render services = SSRF launchers - window.env in public JS = internal network map - Visual SSRF needs no text reflection measure the image size - Always escalate to internal hostnames not just localhost #BugBounty #SSRF #InfoSec #WebSecurity intermediate | 6/6 Key takeaways: - Screenshot/render services = SSRF launchers - window.env in public JS = internal network map - Visual SSRF needs no text reflection — measure the image size - Always escalate to i... |
| 2026-04-14 2026 | Found SSRF vulnerability allowed to access admin panel and delete user account. StockAPI Burp Intruder Admin URL Deleted user account (carlos) #SSRF #WebSecurityAcademy #Portswigger #Lab #Vulnerability pic.x.com/EiIMQEUyxQ intermediate | Found SSRF vulnerability allowed to access admin panel and delete user account. StockAPI Burp Intruder Admin URL Deleted user account (carlos) #SSRF #WebSecurityAcademy #Portswigger #Lab #Vulnerab... |
| 2026-04-14 2026 | Axios CVE-2025-62718 allows a critical NO_PROXY bypass via hostname normalization errors. Protect your internal network from SSRFpatch or normalize today! #AxiosVulnerability #CyberSecurity #SSRF #InfoSec #NodeJS #WebDev securityonline.info/axios-no-proxy pic.x.com/U8wtJItO2r news | Axios CVE-2025-62718 allows a critical NO_PROXY bypass via hostname normalization errors. Protect your internal network from SSRF—patch or normalize today! #AxiosVulnerability #CyberSecurity #SSRF #In... |
| 2026-04-13 2026 | Warning: Critical Path Traversal in the OpenAPIProvider in #FastMCP. CVE-2026-32871 CVSS(4.0): 10. The vulnerability results to an authenticated #SSRF. github.com/advisories/GHS #Patch #Patch #Patch news | Warning: Critical Path Traversal in the OpenAPIProvider in #FastMCP. CVE-2026-32871 CVSS(4.0): 10. The vulnerability results to an authenticated #SSRF. github.com/advisories/GHS… #Patch #Patch #Patch ... |
| 2026-04-12 2026 | Flowise is affected by a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-31829) in its HTTP Node potentially allowing internal network access. Investigate network segmentation and outbound request filtering. #Flowise #SSRF #infosec pulsepatch.io/posts/cve-2026 news | `Flowise` is affected by a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-31829) in its HTTP Node, potentially allowing internal network access. Investigate network segmentation and outbou... |
| 2026-04-11 2026 | A NO_PROXY hostname normalization bypass (CVE-2025-62718) in Axios could lead to SSRF. Implement strict input validation and monitor for patches. #Axios #SSRF #infosec pulsepatch.io/posts/cve-2025 news | A NO_PROXY hostname normalization bypass (CVE-2025-62718) in `Axios` could lead to SSRF. Implement strict input validation and monitor for patches. #Axios #SSRF #infosec pulsepatch.io/posts/cve-2025… ... |
| 2026-04-10 2026 | HackerOne: SSRF in Exchange Leads to ROOT (Shopify) news | HackerOne: SSRF in Exchange Leads to ROOT (Shopify) → hackerone.com |
| 2026-04-10 2026 | PentesterLab: SSRF in PDF Generation intermediate | PentesterLab: SSRF in PDF Generation → pentesterlab.com |
| 2026-04-10 2026 | The Ultimate Sink for SSRFs: HTML To PDF Converters intermediate | The Ultimate Sink for SSRFs: HTML To PDF Converters |
| 2026-04-10 2026 | SSRF to LFI Payload for PDF Generators (CVE-2024-34112) intermediate 3 min read | Payload for CVE-2024-34112 details how to leverage Server-Side Request Forgery (SSRF) within PDF generation processes to achieve Local File Inclusion (LFI). The technique exploits the `<meta http-equiv="refresh">` tag, a known attack vector for XSS, to redirect the server-side PDF renderer to local files like `/etc/hosts` or `/etc/passwd`, as demonstrated in Adobe ColdFusion prior to APSB24-41. Even when file URIs are blocked, HTTP-based SSRF remains a risk. |
| 2026-04-10 2026 | Exploiting PDF Generators: Complete Guide to SSRF intermediate 7 min read | Guide to finding SSRF vulnerabilities in PDF generators, focusing on HTML-to-PDF conversion. It details how unsanitized user input can lead to HTML injection, enabling SSRF, Local File Disclosure (LFD), and other exploits. The guide provides payloads for both full and blind SSRF, including techniques using XHR, Fetch, meta tags, images, and SVG, and explores escalating SSRF in cloud environments targeting metadata endpoints. CVE-2023-33733 is cited as an example of injection leading to code execution. → intigriti.com |
| 2026-04-10 2026 | Mastering SSRF: Ultra-Extensive Guide intermediate | Mastering SSRF: Ultra-Extensive Guide |
| 2026-04-10 2026 | Metabadger: Prevent SSRF via Automated IMDSv2 Upgrades intermediate 7 min read | Tool for preventing SSRF attacks on AWS EC2 by automating upgrades to Instance Metadata Service v2 (IMDSv2). Metabadger diagnoses current IMDS usage, prepares instances for v2, enables mandatory session tokens and header checks, and can disable the service where unnecessary to reduce attack surface. It assists in identifying instances using IAM roles and provides commands to discover metadata service usage and harden configurations across regions, with options to exclude specific instances or perform dry runs. |
| 2026-04-10 2026 | How to Use IMDSv2 for Secure Instance Metadata Access beginner 6 min read | Library detailing the secure implementation of AWS Instance Metadata Service version 2 (IMDSv2). It explains how IMDSv1's lack of authentication makes it vulnerable to SSRF attacks leading to credential theft, contrasting it with IMDSv2's token-based security. The resource covers enabling and enforcing IMDSv2 for new and existing instances, updating shell scripts and Python applications, and checking fleet-wide IMDSv1 usage via CloudWatch metrics and AWS CLI commands. |
| 2026-04-10 2026 | SSRF Cheat Sheet 2025: Exploits, Defenses & Case Studies intermediate | SSRF Cheat Sheet 2025: Exploits, Defenses & Case Studies |
| 2026-04-10 2026 | AWS Defense in Depth Against SSRF with EC2 IMDS intermediate 8 min read | Library for enhancing the EC2 Instance Metadata Service (IMDS) to defend against open firewalls, reverse proxies, and SSRF vulnerabilities. IMDSv2 introduces session-based authentication requiring HTTP PUT requests to initiate a session and obtain a secret token, which then must be included in subsequent requests. This approach effectively mitigates open WAFs, open reverse proxies by checking for `X-Forwarded-For` headers, and many SSRF vulnerabilities by requiring both a PUT request and a valid session token. A final layer of defense against misconfigured layer-3 firewalls and NAT devices is achieved by setting the packet TTL to 1, preventing the session token from leaving the instance. → aws.amazon.com |
| 2026-04-10 2026 | CVE-2025-51591: SSRF Exploit Targets AWS Instance Metadata Service news 2 min read | Writeup of CVE-2025-51591, a critical SSRF vulnerability targeting AWS Instance Metadata Service (IMDS). This exploit allows attackers to steal temporary IAM credentials, leading to unauthorized AWS resource access, privilege escalation, and lateral movement within cloud environments. Organizations using EC2 instances with vulnerable applications accepting user-controlled URLs are at risk. Mitigation involves enabling IMDSv2, auditing applications for SSRF flaws, enforcing least privilege IAM roles, implementing network restrictions, and monitoring CloudTrail logs. |
| 2026-04-10 2026 | Cloud Penetration Testing: AWS, Azure & GCP Guide (2026) intermediate 9 min read | Guide to cloud penetration testing for AWS, Azure, and GCP environments, detailing how it differs from web application assessments. It covers IAM privilege escalation, metadata service exploitation, inter-service trust abuse, and storage bucket exposure. The guide also outlines provider-specific penetration testing rules and what a comprehensive cloud pentest report should contain for compliance evidence, including logging and detection gaps. |
| 2026-04-10 2026 | GCP SSRF on Action Hub Extension - Tenable intermediate 1 min read | Writeup detailing SSRF in GCP Action Hub's DataRobot action used by Looker. This vulnerability allows authenticated attackers to bypass IP allowlists and probe internal APIs by supplying malicious URLs that the Action Hub's server then requests. Google has since addressed the issue. → tenable.com |
| 2026-04-10 2026 | SSRF Exposes Data of Technology, Industrial and Media Organizations intermediate 10 min read | Analysis of CVE-2019-8451, a Server-Side Request Forgery vulnerability affecting Jira, reveals its potential to expose cloud infrastructure metadata. This vulnerability, exploitable without authentication, allows attackers to bypass firewalls and access sensitive information like credentials, configurations, and source code by redirecting requests to internal metadata APIs. Research indicates thousands of internet-exposed Jira instances remain vulnerable, with a significant portion leaking this critical data to technology, industrial, and media organizations. → unit42.paloaltonetworks.com |
| 2026-04-10 2026 | SSRF in the Kubernetes World - Kubernetes Goat intermediate 2 min read | Walkthrough of Server Side Request Forgery (SSRF) exploitation within Kubernetes environments, demonstrating how to leverage cloud instance metadata services (e.g., `169.254.169.254`) and Kubernetes native service discovery to access internal microservices like `metadata-db`. The scenario, inspired by real-world incidents such as a Shopify SSRF leading to ROOT access, guides users to obtain the `k8s-goat-FLAG` by querying internal endpoints and decoding base64 encoded secrets. |
| 2026-04-10 2026 | Exploiting SSRF in Cloud-Only Environments: A Deep Dive advanced 9 min read | Walkthrough demonstrating SSRF exploitation in cloud environments like AWS and Azure. This deep dive details how attackers can leverage Server-Side Request Forgery to access sensitive metadata services, internal applications, and cloud functions by manipulating vulnerable endpoints. The guide utilizes tools such as Burp Suite and SSRFmap to showcase real-world attack scenarios, including retrieving AWS access keys and accessing internal admin panels, ultimately leading to potential data theft, privilege escalation, and system compromise. |
| 2026-04-10 2026 | CVE-2026-35572: SSRF in ChurchCRM news 3 min read | Writeup of CVE-2026-35572, a Server-Side Request Forgery (SSRF) vulnerability in ChurchCRM versions prior to 6.5.3. This flaw allows attackers to inject crafted URLs into the Referer header, forcing the server to make outbound HTTP/HTTPS requests to attacker-controlled hosts. Exploitation can lead to information disclosure or interaction with internal network resources. The vulnerability is fixed in ChurchCRM version 6.5.3. → radar.offseq.com |
| 2026-04-10 2026 | CVE-2026-34936: SSRF in PraisonAI news 3 min read | Writeup detailing CVE-2026-34936, a Server-Side Request Forgery (SSRF) vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 4.5.90 are affected due to the `passthrough()` and `apassthrough()` functions accepting uncontrolled `api_base` parameters, which are then passed to `httpx.Client.request()` without proper validation. This allows attackers to compel the server to make requests to arbitrary internal or external hosts, potentially leading to information disclosure from protected network resources. The issue was patched in version 4.5.90. → radar.offseq.com |
| 2026-04-10 2026 | CVE-2026-39368: SSRF in WWBN AVideo news 3 min read | Writeup of CVE-2026-39368, a CWE-918 Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions 26.0 and prior. Authenticated streamers can exploit this flaw by controlling the `restreamerURL` parameter, allowing them to trigger server-side requests to internal or loopback HTTP services. This vulnerability has a CVSS 3.1 score of 6.5, with a high confidentiality impact due to potential unauthorized access to internal resources. No vendor advisory or patch is currently available. → radar.offseq.com |
| 2026-04-10 2026 | CVE-2026-33182: SSRF in Saloon PHP Library news 6 min read | Writeup of CVE-2026-33182, a Server-Side Request Forgery (SSRF) vulnerability in the Saloon PHP library. Prior to version 4.0.0, Saloon would use an absolute URL provided as a request endpoint directly, ignoring the base URL. This allowed attackers to force the server to send requests, including authentication headers and tokens, to attacker-controlled hosts. The vulnerability, also related to CWE-522 credential exposure, is fixed in version 4.0.0 by rejecting absolute URLs by default. → radar.offseq.com |