CVE-2026-27170: SSRF in OpenSift AI Study Tool

The SSRF vulnerability in OpenSift allows an attacker to craft malicious URLs that, when ingested by the application, trigger requests to unintended targets. This can lead to the exposure of sensitive information residing on internal networks, such as configuration files, database credentials, or even access to internal services. An attacker could potentially map the internal network topology by probing different ports and services. The blast radius extends to any resources accessible from the OpenSift host, potentially including cloud metadata services or other internal APIs. While no direct data exfiltration is guaranteed, the ability to probe internal resources represents a significant security risk.

1. Reserved2026-02-18
2. Published2026-02-20
3. Modified2026-02-25
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27170 is to upgrade OpenSift to version 1.1.3-alpha or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, a temporary workaround involves setting the environment variable OPENSIFTALLOWPRIVATE_URLS=true. However, this should be done with extreme caution, as it relaxes the security restrictions and could potentially expose the system to further risks. Monitor OpenSift logs for unusual outbound requests and implement network segmentation to limit the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to ingest a known malicious URL and verifying that the request is blocked.