CVE-2026-54735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54735", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:07:33.233Z", "datePublished": "2026-07-29T15:59:46.640Z", "dateUpdated": "2026-07-29T18:04:18.670Z"}, "containers": {"cna": {"title": "prebid-server's request forgery vulnerability allows for possible host environment data extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"}, {"name": "https://github.com/prebid/prebid-server/pull/4802", "tags": ["x_refsource_MISC"], "url": "https://github.com/prebid/prebid-server/pull/4802"}, {"name": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3", "tags": ["x_refsource_MISC"], "url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"}, {"name": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0"}], "affected": [{"vendor": "prebid", "product": "prebid-server", "versions": [{"version": "< 4.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-29T15:59:46.640Z"}, "descriptions": [{"lang": "en", "value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."}], "source": {"advisory": "GHSA-4p3g-4hcj-wpvx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T18:04:08.706808Z", "id": "CVE-2026-54735", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:04:18.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T18:04:08.706808Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:04:14.876Z"}}], "cna": {"title": "prebid-server's request forgery vulnerability allows for possible host environment data extraction", "source": {"advisory": "GHSA-4p3g-4hcj-wpvx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "prebid", "product": "prebid-server", "versions": [{"status": "affected", "version": "< 4.4.0"}]}], "references": [{"url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx", "name": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/prebid/prebid-server/pull/4802", "name": "https://github.com/prebid/prebid-server/pull/4802", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3", "name": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0", "name": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-29T15:59:46.640Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54735", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:04:18.670Z", "dateReserved": "2026-06-15T23:07:33.233Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-29T15:59:46.640Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "prebid-server", "vendor": "prebid", "versions": [{"status": "affected", "version": "< 4.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:prebid:prebid_server:*:*:*:*:*:go:*:*", "matchCriteriaId": "1E0ADE95-CC2A-42D3-989C-464B8DFB15B7", "versionEndExcluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."}, {"lang": "es", "value": "Prebid Server es una soluci\u00f3n de c\u00f3digo abierto para ejecutar subastas de publicidad en tiempo real en la nube. Antes de la versi\u00f3n 4.4.0, ciertos adaptadores de postor en Prebid Server interpolan par\u00e1metros proporcionados por el usuario en URLs de solicitudes salientes sin validar correctamente los valores de host y subdominio, permitiendo que par\u00e1metros de solicitud de puja manipulados causen solicitudes del lado del servidor a destinos no deseados y potencialmente expongan servicios de red internos o puntos finales de servidor sensibles. Este problema est\u00e1 solucionado en la versi\u00f3n 4.4.0."}], "id": "CVE-2026-54735", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54735", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T18:04:08.706808Z", "version": "2.0.3"}}]}, "published": "2026-07-29T16:17:54.317", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/prebid/prebid-server/pull/4802"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "prebid-server", "source": "cna", "vendor": "prebid"}, "product": "prebid-server", "vendor": "prebid"}], "created": "2026-07-30T14:01:58.814523+00:00", "updated": "2026-08-03T13:15:05.192279+00:00", "vendors": ["prebid", "prebid$PRODUCT$prebid-server"]}