CVE-2026-54885

Deferred Deferred - Pending Action

Server-Side Request Forgery in Boruta OAuth Server

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: EEF

Description

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri parameter from the authorization request via Finch.build(:get, request_uri) |> Finch.request(OpenIDHttpClient). Boruta.Openid.parse_registration_params/2 in lib/boruta/openid.ex dereferences the jwks_uri supplied in an OpenID Connect dynamic client registration request. Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1 in lib/boruta/adapters/ecto/clients.ex later refreshes the stored jwks_uri for an existing client. In all three paths the only validation is that the URI parses with a scheme (and one of the two request_uri clauses does not even restrict the scheme to http or https). The implementations do not require HTTPS, do not enforce a host or IP allowlist, do not reject loopback, private, link-local, or other non-public ranges after DNS resolution, do not cap response size, and do not constrain redirects. An attacker can therefore steer the server's HTTP client at arbitrary network targets reachable from the Boruta host. This issue affects boruta: from 2.3.2 before 2.3.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-54885

EUVD

EUVD-2026-51143

Affected Vendors & Products

Vendor	Product	Version / Range
malach-it	boruta	From 2.3.2 (inc) to 2.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Boruta OAuth/OpenID authorization server. It allows an unauthenticated remote attacker to trick the server into making outbound HTTP requests to arbitrary URIs, including internal services or cloud metadata endpoints. The issue occurs because the server fetches remote URIs provided by the requester without proper validation of the target, such as checking the scheme, host, or network range.

Detection Guidance

Check for unusual outbound HTTP requests from the Boruta server, especially to internal or cloud metadata endpoints. Monitor logs for requests to untrusted URIs in OAuth/OpenID flows. Verify if the server is running affected versions (2.3.2 to 2.3.6).

Commands: Check Boruta logs for request_uri or jwks_uri parameters. Use network monitoring tools like tcpdump or Wireshark to inspect outbound traffic from the server.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate sensitive data, or interact with cloud provider metadata services to obtain credentials or other secrets. This could lead to unauthorized access, data breaches, or further network compromise depending on the server's environment and network configuration.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection), HIPAA (health information privacy), or other regulations by enabling unauthorized access to sensitive data or systems. Organizations using affected versions of Boruta may face compliance failures, legal penalties, or reputational damage due to potential data exposure or unauthorized transactions.

Mitigation Strategies

Upgrade Boruta to version 2.3.7 or later to address the vulnerability. Ensure all HTTP requests validate URI schemes, restrict to HTTPS, and enforce allowlists for target hosts.

Disable dynamic client registration if not required. Implement network-level restrictions to block outbound requests to sensitive endpoints like cloud metadata services.

Hi! I’m here to help you understand CVE-2026-54885. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70