CVE-2026-90486

Received Received - Intake

Server-Side Request Forgery in openstatusHQ

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulDB

Description

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-12

Last Modified

2026-09-12

Generated

2026-09-13

AI Q&A

2026-09-13

EPSS Evaluated

N/A

NVD

CVE-2026-90486

EUVD

EUVD-2026-76917

Affected Vendors & Products

Vendor	Product	Version / Range
openstatushq	openstatus	to f04c827112f30a11d571ebdad3892826034d6265 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the openstatusHQ openstatus software. It affects a file handling custom domain rewrites and can be exploited remotely. The issue was silently patched without clear version details due to the software's rolling release model.

Detection Guidance

The vulnerability is a server-side request forgery (SSRF) in openstatusHQ. Detection may involve monitoring outbound requests from the affected file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. Check for unusual or unauthorized external requests originating from this component.

Impact Analysis

An attacker could exploit this to make unauthorized requests from your server, potentially accessing internal systems or sensitive data. This could lead to data breaches, service disruption, or further attacks on your infrastructure.

Mitigation Strategies

Apply the silent patch identified as 86f370c9c20074c3c3fdec53a359874b8e670fd4. Since the product uses a rolling release model, ensure your instance is updated to the latest version to include this fix.

Hi! I’m here to help you understand CVE-2026-90486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70