openedx openedx-platform up to 169.254.169.254 Internal Network Service requests.get metadata_url server-side request forgery

Summaryinfo

A vulnerability classified as critical was found in openedx openedx-platform up to 169.254.169.254. This vulnerability affects the function requests.get of the component Internal Network Service Handler. Such manipulation of the argument metadata_url leads to server-side request forgery. This vulnerability is traded as CVE-2026-42858. The attack may be launched remotely. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in openedx openedx-platform up to 169.254.169.254. Affected by this issue is the function requests.get of the component Internal Network Service Handler. The manipulation of the argument metadata_url with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-42858 since 04/30/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Applying the patch 6fda1f120ff5a590d120ae1180185525f399c6d0 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• openedx

Name

• openedx-platform

Version

• 169.254.169.254

Website

• Product: https://github.com/openedx/openedx-platform/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion