CVE-2026-24772: SSRF in OpenProject Hocuspocus Synchronization Server

The SSRF vulnerability in OpenProject's Hocuspocus Synchronization Server allows an attacker to craft malicious requests that the server will execute on their behalf. This can lead to several severe consequences. An attacker could potentially access internal services and resources that are not directly exposed to the internet, such as internal databases, configuration files, or other sensitive systems. They might be able to read sensitive data, modify configurations, or even execute commands on those internal systems, depending on their permissions. Furthermore, the attacker could potentially use the server as a proxy to scan internal networks or launch attacks against other internal systems, significantly expanding the blast radius of the vulnerability. The encryption of the authentication token, while intended to provide security, does not prevent the SSRF attack due to the validation flaw.

1. Reserved2026-01-26
2. Published2026-01-28
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24772 is to immediately upgrade OpenProject to version 17.0.2 or later, which includes the necessary fix for the backend URL validation issue. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to restrict network access to the Hocuspocus Synchronization Server using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to suspicious or unauthorized domains and IP addresses. Another workaround involves carefully reviewing and restricting the allowed domains and protocols that the synchronization server is permitted to access. Regularly monitor the synchronization server's logs for any unusual or suspicious activity. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a crafted request and verifying that it is blocked.