CVE-2026-54735

Analyzed Analyzed - Analysis Complete

Path Traversal in Prebid Server Bidder Adapters

Publication date: 2026-07-29

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54735

Affected Vendors & Products

Vendor	Product	Version / Range
prebid	prebid_server	to 4.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Prebid Server before version 4.4.0 has a vulnerability where certain bidder adapters insert user-controlled parameters into outbound request URLs without validating host or subdomain values. This allows attackers to manipulate URLs to send requests to unintended internal services or sensitive endpoints, potentially exposing server infrastructure or data.

Detection Guidance

Detecting this vulnerability requires checking if your Prebid Server version is below 4.4.0. Use commands like 'curl -s https://your-prebid-server/status | grep version' or check your deployment logs for version details. Monitor outbound requests for unusual destinations or internal network access patterns.

Impact Analysis

This vulnerability could allow attackers to access internal network services, exfiltrate sensitive data, or interact with unauthorized endpoints. If exploited, it may lead to data breaches, service disruption, or unauthorized system access, depending on the exposed services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Prebid Server to version 4.4.0 or later immediately. If upgrading is not possible, restrict network access to the server and validate all user-supplied parameters in bid requests to prevent server-side request forgery.

Hi! I’m here to help you understand CVE-2026-54735. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70