Executive Summary

CVE-2026-31974 is a Blind Server-Side Request Forgery (SSRF) vulnerability found in OpenProject versions prior to 17.2.0.

The vulnerability exists in the SMTP test endpoint (POST /admin/settings/mail_notifications), which accepts arbitrary host and port values.

This endpoint shows measurable differences in response behavior depending on whether the target IP exists and whether the specified port is open.

An attacker with appropriate access privileges can exploit these timing and error response differences to map internal hosts and identify reachable services and ports.

Additionally, OpenProject’s webhook functionality allows creation of webhooks pointing to arbitrary IP addresses, which similarly enables SSRF attacks to scan the internal network.

This vulnerability requires high privileges and has high attack complexity, with no user interaction needed.

It was fixed in OpenProject version 17.2.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with high privileges to perform internal network reconnaissance by mapping internal hosts and identifying which services and ports are reachable.

The impact on confidentiality is low, and there is no impact on integrity or availability.

Because the attacker can scan internal networks, it may expose information about internal infrastructure that could be used in further attacks.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the SMTP test endpoint of OpenProject (POST /admin/settings/mail_notifications) with arbitrary host and port values and observing differences in response timing and error messages. These differences indicate whether the target IP exists and if the port is open, revealing potential SSRF exploitation.'}, {'type': 'paragraph', 'content': 'Similarly, checking if webhooks in OpenProject are configured to point to arbitrary IP addresses can help identify if the SSRF issue is exploitable.'}, {'type': 'paragraph', 'content': 'Since the vulnerability requires high privileges, detection commands should be run with appropriate access.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send POST requests to /admin/settings/mail_notifications with different host and port parameters and measure response times and error messages.'}, {'type': 'list_item', 'content': "Example curl command: curl -X POST -d 'host=TARGET_IP&port=TARGET_PORT' https://your-openproject-instance/admin/settings/mail_notifications -v"}, {'type': 'list_item', 'content': 'Monitor response behavior differences to infer if the target IP and port are reachable.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade OpenProject to version 17.2.0 or later, where this vulnerability has been fixed.

Until the upgrade can be performed, restrict access to the SMTP test endpoint and webhook configuration features to only trusted, high-privilege users to reduce the risk of exploitation.

Additionally, monitor and audit webhook configurations to ensure they do not point to arbitrary or untrusted internal IP addresses.

Useful 0 Not Useful 0