PT-2026-37284 · Unknown · Open Edx Enterprise Service

Ik0Z · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42860

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open edx Enterprise Service versions 7.0.2 through 7.0.4

Description An authenticated user with the Enterprise Admin role can trigger a server-side HTTP request. By using the 'SAMLProviderConfigViewSet' PATCH endpoint, a user can set the metadata source variable in SAMLProviderConfig to an arbitrary URL. Subsequently, calling the 'sync provider data' endpoint in 'SAMLProviderDataViewSet' triggers the fetch metadata xml() function, which passes the URL to requests.get() without scheme enforcement, IP filtering, or timeouts. This allows for Server-Side Request Forgery (SSRF), which could be used to steal cloud credentials from instance metadata services, scan internal networks, or access internal APIs.

Recommendations Update Open edx Enterprise Service to version 7.0.5. As a temporary workaround, restrict network-level egress filtering to block outbound connections from the server to 169.254.0.0/16 and RFC 1918 private IP ranges.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42860

GHSA-64CV-VXPR-J6VC

PYSEC-2026-58

Affected Products

Open Edx Enterprise Service

References · 8

• 🔥 https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc · Exploit
• https://osv.dev/vulnerability/GHSA-64cv-vxpr-j6vc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42860 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-58 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/edx-enterprise/PYSEC-2026-58.yaml · Note
• https://github.com/openedx/edx-enterprise · Note
• https://t.me/cveNotify/163125 · Telegram Post
• https://twitter.com/CVEnew/status/2053932397251686607 · Twitter Post