CVE-2026-33182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33182", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T22:16:36.720Z", "datePublished": "2026-03-26T00:22:14.472Z", "dateUpdated": "2026-03-26T14:18:29.802Z"}, "containers": {"cna": {"title": "Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp"}, {"name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"version": "< 4.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:58.139Z"}, "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request\u2014and any authentication headers, cookies, or tokens attached by the connector\u2014was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis."}], "source": {"advisory": "GHSA-c83f-3xp6-hfcp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T14:18:22.841270Z", "id": "CVE-2026-33182", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:18:29.802Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33182", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T14:18:22.841270Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T14:18:26.473Z"}}], "cna": {"title": "Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL", "source": {"advisory": "GHSA-c83f-3xp6-hfcp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "saloonphp", "product": "saloon", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "references": [{"url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp", "name": "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "name": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request\u2014and any authentication headers, cookies, or tokens attached by the connector\u2014was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T00:27:58.139Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33182", "state": "PUBLISHED", "dateUpdated": "2026-03-26T14:18:29.802Z", "dateReserved": "2026-03-17T22:16:36.720Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T00:22:14.472Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "saloon", "vendor": "saloonphp", "versions": [{"status": "affected", "version": "< 4.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saloon:saloon:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DA20E08-DBB0-4ACD-BED9-550F3ED97E3D", "versionEndExcluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request\u2014and any authentication headers, cookies, or tokens attached by the connector\u2014was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis."}, {"lang": "es", "value": "Saloon es una biblioteca PHP que proporciona a los usuarios herramientas para construir integraciones de API y SDKs. Antes de la versi\u00f3n 4.0.0, al construir la URL de la petici\u00f3n, Saloon combinaba la URL base del conector con el endpoint de la petici\u00f3n. Si el endpoint era una URL absoluta v\u00e1lida, el c\u00f3digo usaba esa URL tal cual e ignoraba la URL base. La petici\u00f3n \u2014y cualquier encabezado de autenticaci\u00f3n, cookies o tokens adjuntos por el conector\u2014 se enviaba entonces al host controlado por el atacante. Si el endpoint pod\u00eda ser influenciado por la entrada del usuario o la configuraci\u00f3n (p. ej., redirect_uri, URL de callback), esto permit\u00eda la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) y/o la fuga de credenciales a un host de terceros. La soluci\u00f3n en la versi\u00f3n 4.0.0 es rechazar las URLs absolutas en el endpoint: URLHelper::join() lanza InvalidArgumentException cuando el endpoint es una URL absoluta v\u00e1lida, a menos que se permita expl\u00edcitamente, lo que requiere que los llamadores opten por la funcionalidad por conector o por petici\u00f3n."}], "id": "CVE-2026-33182", "lastModified": "2026-06-17T10:37:05.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33182", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T14:18:22.841270Z", "version": "2.0.3"}}]}, "published": "2026-03-26T01:16:27.043", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "saloon", "source": "cna", "vendor": "saloonphp"}, "product": "saloon", "vendor": "saloonphp"}], "analysis": {"en": {"generated_at": "2026-03-30T18:30:21.514448+00:00", "value": {"mitigation_remediation": ["Upgrade Saloon to version 4.0.0 or newer, which rejects absolute URLs in endpoints unless explicitly allowed. ", "Modify configuration or code to disallow or carefully filter any absolute URLs in request endpoints, especially for redirect_uri or callback parameters. ", "Validate or sanitize user input that determines endpoint URLs to ensure only relative paths or trusted domains are used. ", "Review connector settings to eliminate externally controllable redirect_uri or callback URLs that could be manipulated by an attacker."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery and Credential Leakage"}, "threat_synthesis": {"affected_systems": "The PHP library Saloon, published by saloonphp, is impacted. All versions earlier than 4.0.0 contain the flaw. An attacker can exploit it when an endpoint value can be supplied from user input or system configuration, such as redirect_uri or callback URLs.", "description_and_impact": "Saloon builds request URLs by combining a connector\u2019s base URL with an endpoint. When that endpoint is a valid absolute URL, the library sends the request to the absolute location, bypassing the base URL and attaching any authentication headers, cookies, or tokens. This allows an attacker to cause the server to send traffic to an arbitrary host, potentially exfiltrating credentials or accessing internal resources. The flaw is a Server\u2011Side Request Forgery (CWE\u2011918) that can also result in credential leakage (CWE\u2011522).", "risk_and_exploitability": "The CVSS score of 6.6 indicates moderate severity, while the EPSS score is below 1%, suggesting that exploitation is not common in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires that the application uses Saloon and that an absolute endpoint can be influenced by the attacker. The likely attack vector is a server\u2011side request forgery where the attacker supplies a crafted absolute URL as the request endpoint. If successful, the server will reach the attacker\u2011controlled host, potentially leaking authentication tokens or exposing internal services."}}}}, "created": "2026-03-26T11:30:56.678053+00:00", "updated": "2026-03-30T20:57:46.559959+00:00", "vendors": ["saloonphp", "saloonphp$PRODUCT$saloon"]}