CVE-2026-28677: SSRF in OpenSift AI Study Tool

The SSRF vulnerability in OpenSift allows an attacker to craft malicious URLs that the application processes, effectively using the server to make requests to unintended destinations. In non-localhost deployments, this could lead to unauthorized access to internal services, databases, or cloud resources. An attacker could potentially exfiltrate sensitive data, perform reconnaissance on the internal network, or even trigger denial-of-service conditions by overwhelming internal services with requests. The lack of proper credentialed URL, non-standard port, and cross-host redirect restrictions significantly expands the potential attack surface.

1. Reserved2026-03-02
2. Published2026-03-06
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28677 is to upgrade OpenSift to version 1.6.3-alpha or later, which includes the necessary fixes. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the OpenSift server to only necessary destinations. Employing a Web Application Firewall (WAF) with SSRF protection rules can also help block malicious requests. Thoroughly review and restrict the URL ingest pipeline configuration to enforce stricter destination limitations, specifically addressing credentialed URLs, non-standard ports, and cross-host redirects. After upgrading, confirm the fix by attempting to access internal resources via the vulnerable URL ingest pipeline and verifying that the requests are blocked.