CVE-2026-53508
Received Received - Intake

OpenAPI Spec External Ref Bypass in oasdiff

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-53508
EUVD
EUVD-2026-68727

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openapi_diff oasdiff From 1.13.2 (inc) to 1.18.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

oasdiff is a tool for comparing OpenAPI specs. From versions 1.13.2 to 1.18.0, it failed to enforce the --allow-external-refs=false setting when loading specs from Git revisions. This allowed external references to bypass security checks, enabling potential SSRF or local file read attacks even when the setting was explicitly disabled.

Detection Guidance

To detect this vulnerability, check if your oasdiff version is between 1.13.2 and 1.18.0. Run: oasdiff --version. If the version falls in this range, the system is vulnerable. Additionally, test if external refs are improperly resolved via git revisions by running: oasdiff diff --allow-external-refs=false main:spec.yaml untrusted.yaml and checking for unexpected file or network access.

Impact Analysis

If you process untrusted OpenAPI specs from Git using oasdiff versions 1.13.2-1.18.0 with --allow-external-refs=false, an attacker could craft malicious $ref values to read local files or make unauthorized HTTP requests (SSRF). This affects both CLI users and Go library consumers using load.NewSpecInfo.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to local files or internal systems through SSRF attacks. If external refs are disabled to prevent such risks, the bypass in git revisions undermines this security control, exposing sensitive data or systems to potential breaches.

Mitigation Strategies

Upgrade oasdiff to version 1.18.1 or later. Avoid using the git-revision input form (e.g., main:openapi.yaml) for untrusted specifications when external refs are disabled. If upgrading is not possible, disable git-revision usage entirely until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart