CVE-2026-28680: SSRF in Ghostfolio Wealth Management

The SSRF vulnerability in Ghostfolio presents a significant risk. An attacker can exploit this flaw to exfiltrate sensitive cloud metadata, specifically Instance Metadata Service (IMDS) data, which often contains credentials and configuration information. Furthermore, the attacker can use the SSRF to probe internal network services, potentially identifying and exploiting other vulnerabilities within the organization's infrastructure. Successful exploitation could lead to unauthorized access to sensitive financial data, compromise of cloud environments, and broader network breaches. The ability to probe internal services significantly expands the potential blast radius of this vulnerability.

1. Reserved2026-03-02
2. Published2026-03-06
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28680 is to immediately upgrade Ghostfolio to version 2.245.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the Ghostfolio server, limiting outbound connections to only necessary services. Implement strict input validation on the asset import feature to prevent malicious URLs. Web Application Firewalls (WAFs) can be configured to block requests to known malicious domains or patterns associated with SSRF attacks. After upgrading, verify the fix by attempting to import a test asset with a known internal or external URL to confirm that the SSRF vulnerability has been resolved.