OpenSift: Restrições insuficientes de destino de URL no fluxo de ingestão podem permitir acesso interno no estilo SSRF

The SSRF vulnerability in OpenSift allows an attacker to craft malicious URLs that the application processes, effectively using the server to make requests to unintended destinations. In non-localhost deployments, this could lead to unauthorized access to internal services, databases, or cloud resources. An attacker could potentially exfiltrate sensitive data, perform reconnaissance on the internal network, or even trigger denial-of-service conditions by overwhelming internal services with requests. The lack of proper credentialed URL, non-standard port, and cross-host redirect restrictions significantly expands the potential attack surface.

Organizations utilizing OpenSift in production environments, particularly those with non-localhost deployments, are at risk. Environments where OpenSift processes data from untrusted sources are especially vulnerable. Shared hosting environments where OpenSift instances share network resources also face increased risk.

• linux / server: Examine OpenSift logs for unusual outbound requests to internal or unexpected external hosts. Use journalctl -u opensift to filter for HTTP requests originating from the OpenSift process.

journalctl -u opensift | grep -i "http:" | grep -v "localhost"

• generic web: Monitor access logs for requests to the URL ingest endpoint with suspicious parameters. Look for URLs containing internal IP addresses or hostnames.

grep -i -E "(127.0.0.1|192.168.0.0/16|internal.example.com)" /var/log/apache2/access.log

1. 2026-03-06Disclosure

   disclosure

1. Reservado2026-03-02
2. Publicada2026-03-06
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-28677 is to upgrade OpenSift to version 1.6.3-alpha or later, which includes the necessary fixes. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the OpenSift server to only necessary destinations. Employing a Web Application Firewall (WAF) with SSRF protection rules can also help block malicious requests. Thoroughly review and restrict the URL ingest pipeline configuration to enforce stricter destination limitations, specifically addressing credentialed URLs, non-standard ports, and cross-host redirects. After upgrading, confirm the fix by attempting to access internal resources via the vulnerable URL ingest pipeline and verifying that the requests are blocked.