Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-55421

CVSS Base Score
6.8 MEDIUM
Primary Weakness
CWE-918
Published Date
Sep 2, 2026
Data Source
NVD API

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.

Related Vulnerabilitiesvia CWE-918

CVE-2026-3543110 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network

CWE-918
CVE-2026-322109.3 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network

CWE-918
CVE-2026-3218610 CRITICAL

Server-Side Request Forgery (SSRF) in Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network

CWE-918
CVE-2026-48740 LOW

CVE-2026-4874: Server-Side Request Forgery in Keycloak

CWE-918
CVE-2026-45287.3 HIGH

A vulnerability was determined in trueleaf ApiFlow 0.

CWE-918
CVE-2024-562796.5 MEDIUM

Server-Side Request Forgery (SSRF) — Cloud metadata access

CWE-918

Is your system affected?

Precogs AI detects CVE-2026-55421 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo