PT-2026-39713 · Unknown · Open Edx Platform

Ik0Z · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-42858

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open edX Platform (affected versions not specified)

Description The 'sync provider data' endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL through the metadata url POST parameter. This URL is processed by the fetch metadata xml() function using requests.get() without URL validation, IP filtering, or scheme enforcement. This allows an attacker with Enterprise Admin privileges to force the server to make HTTP requests to internal network services, cloud metadata endpoints, or other destinations controlled by the attacker.

Recommendations Apply the fixes provided in commits 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-42858

GHSA-328G-7H4G-R2M9

Affected Products

Open Edx Platform

References · 7

• 🔥 https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42858.json · Exploit
• https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054 · Patch
• https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42858 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42858 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053932400221233427 · Twitter Post