CVE-2026-41321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41321", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T14:01:46.671Z", "datePublished": "2026-04-24T17:04:06.118Z", "dateUpdated": "2026-04-24T18:33:24.408Z"}, "containers": {"cna": {"title": "@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6"}], "affected": [{"vendor": "withastro", "product": "@astrojs/cloudflare", "versions": [{"version": "< 13.1.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T17:04:06.118Z"}, "descriptions": [{"lang": "en", "value": "@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10."}], "source": {"advisory": "GHSA-88gm-j2wx-58h6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T18:27:06.347024Z", "id": "CVE-2026-41321", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T18:33:24.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41321", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T18:27:06.347024Z"}}}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T18:27:22.745Z"}}], "cna": {"title": "@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint", "source": {"advisory": "GHSA-88gm-j2wx-58h6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.2, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "withastro", "product": "@astrojs/cloudflare", "versions": [{"status": "affected", "version": "< 13.1.10"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6", "name": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T17:04:06.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41321", "state": "PUBLISHED", "dateUpdated": "2026-04-24T18:33:24.408Z", "dateReserved": "2026-04-20T14:01:46.671Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T17:04:06.118Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "@astrojs/cloudflare", "vendor": "withastro", "versions": [{"status": "affected", "version": "< 13.1.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10."}, {"lang": "es", "value": "@astrojs/cloudflare es un adaptador SSR para usar con objetivos de Cloudflare Workers. Antes de la versi\u00f3n 13.1.10, la llamada a fetch() para im\u00e1genes remotas en packages/integrations/cloudflare/src/utils/image-binding-transform.ts utiliza el comportamiento predeterminado redirect: \u2019follow\u2019. Esto permite al Cloudflare Worker seguir redirecciones HTTP a URLs arbitrarias, eludiendo la comprobaci\u00f3n de lista de permitidos de dominio isRemoteAllowed() que solo valida la URL inicial. Esta vulnerabilidad es causada por una correcci\u00f3n incompleta para CVE-2025-58179. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 13.1.10."}], "id": "CVE-2026-41321", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41321", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T18:27:06.347024Z", "version": "2.0.3"}}]}, "published": "2026-04-24T18:16:28.783", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.1.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@astrojs/cloudflare", "source": "cna", "vendor": "withastro"}, "product": "astro", "vendor": "withastro"}], "analysis": {"en": {"generated_at": "2026-04-28T13:40:21.156169+00:00", "value": {"mitigation_remediation": ["Upgrade @astrojs/cloudflare to version 13.1.10 or newer", "Configure fetch calls to disable automatic redirects (e.g., set redirect:'manual') and add explicit domain validation for any redirects that occur", "Audit and review Cloudflare Worker code to ensure only trusted image URLs are used in image-binding-transform and remove any hard\u2011coded or externally supplied URLs", "Monitor outbound HTTP traffic from Workers for unexpected or unauthorized destinations to detect potential misuse"], "summary": {"action": "Apply Update", "impact": "Remote Server Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Vendors and products affected are the withastro collection, specifically the @astrojs/cloudflare adapter. Any installation using versions earlier than 13.1.10 is vulnerable. Versions 13.1.10 and later contain the fix.", "description_and_impact": "The vulnerability resides in the @astrojs/cloudflare adapter, where the fetch() call used for remote images follows HTTP redirects by default. This bypasses the isRemoteAllowed() domain allowlist which only validates the initial URL, enabling the Cloudflare Worker to request arbitrary URLs. The result is an SSRF condition that could allow an attacker to access internal network resources, causing potential confidentiality and availability impacts.", "risk_and_exploitability": "The CVSS base score is 2.2, indicating a low severity, and the EPSS score is below 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to execute JavaScript in the Cloudflare Worker context, which is a typical remote code path for the adapter. Because the flaw arises from automatic redirection handling, an attacker can simply supply a malicious URL to trigger the redirect cycle. However, due to the low exploitation probability, this vulnerability is unlikely to see widescale use, but should still be remediated promptly."}}}}, "created": "2026-04-28T09:17:55.737814+00:00", "updated": "2026-04-28T13:45:06.141409+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}