CVE-2026-62282: OpenCVE: Server-Side Request Forgery (SSRF) in notifications
OpenCVE contains a Server-Side Request Forgery (SSRF) vulnerability in the notification testing functionality for both Webhook and Slack integrations.
An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTP(S) endpoints. Insufficient validation of target destinations allows requests to be sent to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, and cloud metadata services.
Successful exploitation could allow an attacker to interact with internal services that are not otherwise accessible from the Internet and retrieve information from HTTP-based services reachable by the OpenCVE instance.
References
- github.com/advisories/GHSA-ch3g-4xvr-674q
- github.com/opencve/opencve/commit/0af7f894debc95c67fa53e7ba5a6cdecb10c34f0
- github.com/opencve/opencve/issues/743
- github.com/opencve/opencve/pull/747
- github.com/opencve/opencve/releases/tag/v3.0.0
- github.com/opencve/opencve/security/advisories/GHSA-ch3g-4xvr-674q
- nvd.nist.gov/vuln/detail/CVE-2026-62282
Code Behaviors & Features
Detect and mitigate CVE-2026-62282 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →