CVE-2026-28329 in Observability Self-Hosted
Summary
by MITRE • 10/20/2026
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The identified vulnerability in SolarWinds Observability Self-Hosted represents a critical security flaw classified as a Server-Side Request Forgery, commonly abbreviated as SSRF. This type of vulnerability arises when an application accepts user-supplied input and uses it to construct URLs or network requests without sufficiently validating the destination address. In this specific instance, authenticated attackers are able to exploit this weakness by manipulating parameters that control outbound connections initiated by the application server. The core technical flaw lies in the insufficient validation of URL schemes, hostnames, and IP addresses provided during API calls or configuration updates within the observability platform. By crafting malicious requests, an attacker can trick the backend service into fetching resources from internal network locations that are otherwise inaccessible to external users, effectively bypassing perimeter security controls such as firewalls and access control lists.
From a technical perspective, SSRF vulnerabilities allow attackers to interact with back-end systems using the application server's own identity and permissions. This capability is particularly dangerous because it transforms the compromised web application into a proxy for attacking internal infrastructure. The attacker can probe internal services running on localhost or private IP ranges that are not exposed to the public internet. These internal targets may include database servers, management interfaces of other network devices, cloud metadata endpoints, or microservices within the observability architecture itself. Since the requests originate from the application server, they often bypass authentication mechanisms designed for external clients and traverse security zones as if they were legitimate administrative traffic. This undermines the principle of least privilege and allows lateral movement across the internal network topology.
The operational impact of this vulnerability is severe, potentially leading to unauthorized access to sensitive data stored in internal services or complete compromise of adjacent systems within the organization's infrastructure. An attacker could exploit SSRF to read local files on the server if certain protocols are supported, such as file://, although modern implementations often restrict these schemes. More commonly, attackers use this vector to scan internal ports and identify running services with known vulnerabilities. They may also attempt to exfiltrate data by sending requests containing sensitive information from internal databases or configuration stores back to an attacker-controlled server. In cloud environments, SSRF can be leveraged to access instance metadata services, which often contain temporary credentials for accessing other cloud resources like storage buckets or virtual machine instances, thereby escalating the scope of the breach significantly beyond the initial application compromise.
This vulnerability aligns with CWE-918, Server-Side Request Forgery (SSRF), as defined by the Common Weakness Enumeration standard. It also maps to specific tactics within the MITRE ATT&CK framework, particularly T1571 which covers Non-Standard Ports and potentially T1046 Network Service Discovery if used for scanning internal services. The exploitation path typically involves initial authentication followed by crafting a malicious HTTP request that specifies an arbitrary destination URL in parameters related to webhook configurations, integrations, or diagnostic tools within the SolarWinds Observability interface.
To mitigate this risk, organizations must apply the latest security patches provided by SolarWinds immediately if available for their specific version of the Self-Hosted observability platform. In addition to patching, network segmentation strategies should be reviewed and strengthened to limit the ability of application servers to communicate with sensitive internal resources that do not require such access. Implementing strict egress filtering rules on firewalls can restrict outbound connections from the server to only known and necessary destinations, thereby reducing the attack surface for SSRF exploitation. Furthermore, input validation mechanisms within custom integrations or extensions should be hardened to reject URLs pointing to private IP ranges, loopback addresses, or non-HTTP schemes unless explicitly required by business logic. Regular security audits and penetration testing focused on server-side request manipulation are recommended to identify similar weaknesses in other components of the observability stack before they can be exploited by malicious actors.