CVE-2026-28677highCWE-918

CVE-2026-28677: falha de alta gravidade em OpenSift

OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access

Publicada em

Seguir esta CVE+ Monitorar OpenSift

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.3%
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Produtos afetados
OpenSift · OpenSift
CVEs relacionadas — OpenSift

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28676HIGHOpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operationsEPSS 0.5%CVE-2026-27169HIGHOpenSift: Persistent XSS Chat Tool RenderingEPSS 0.4%CVE-2026-28675MEDIUMOpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpointsEPSS 0.3%CVE-2026-27170HIGHOpenSift: SSRF risk in URL ingestion endpointEPSS 0.2%CVE-2026-27189MEDIUMOpenSift: Race-prone local persistence could cause state corruption/lossEPSS 0.1%