漏洞关键信息 漏洞描述 漏洞名称: SSRF risk in OpenSift URL ingestion endpoint CVE ID: CVE-2026-27170 发布日期: 2 days ago 发布者: mdavistffhrtporo GHSA ID: GHSA-3w2r-hj5p-h6pp 漏洞严重性 严重性评级: Medium CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: Low - Availability: None 影响和风险 OpenSift URL ingest previously allowed overly permissive server-side fetch behavior, which could be coerced into requesting unsafe targets. Potential access/probing of private/local network resources. CWE CWE-918: Server-Side Request Forgery (SSRF) CWE-20: Improper Input Validation (optional secondary) 影响版本 受影响版本: < v1.1.3-alpha 已修复版本: v1.1.3-alpha 已修复的包: - : v1.1.3-alpha - : v1.1.3-alpha 修复措施 修复描述: Validation was hardened to block localhost/private targets, validate DNS-resolved destinations, enforce safe redirect handling, reject unsupported schemes, detect redirect loops, and cap redirect hops. 修复版本: v1.1.3-alpha 解决方案 临时解决方案: Upgrade to v1.1.3-alpha or later. 环境特定例外: For trusted local-only exceptions, use with caution. 参考