Read the docs
TI-2026-31065 Aliases CVE-2026-42858

Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint

Priority HIGH 76CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed openedx-platform (openedx): 6fda1f120ff5a590d120ae1180185525f399c6d0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openedxopenedx-platformbefore 6fda1f120ff5a590d120ae1180185525f399c6d06fda1f120ff5a590d120ae1180185525f399c6d0Patch availableCNA
  • openedx-platform Vendoropenedx Affected before 6fda1f120ff5a590d120ae1180185525f399c6d0 Fixed in 6fda1f120ff5a590d120ae1180185525f399c6d0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:*before 2026-04-24Vulnerableopenedx
  • cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:* Versions before 2026-04-24 Vulnerable ·openedx

Remediation

  • Fix · CNA openedx-platform (openedx) Fixed in 6fda1f120ff5a590d120ae1180185525f399c6d0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42858

References

Exploit 1

Patch 2

  • TI-2026-27540 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter CVSS 3.1MEDIUM 6.1
  • TI-2026-31064 Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization CVSS 3.1MEDIUM 5.4
  • TI-2024-29377 openedx-translations's Atlas translations for Open edX missing validation CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences