Read the docs
TI-2026-38582 Aliases CVE-2026-53508GHSA-2jcc-mxv7-p3f9

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

Priority LOW 27CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-693, CWE-73 and the CVSS impact.

Summary

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix Fixed oasdiff (oasdiff): 1.18.1github.com/oasdiff/oasdiff (Go): 1.18.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oasdiffoasdiff1.13.2 to before 1.18.11.18.1Patch availableCNA
—github.com/oasdiff/oasdiff (Go)1.13.2 to before 1.18.11.18.1Patch availableGHSA-2jcc-mxv7-p3f9
  • oasdiff Vendoroasdiff Affected 1.13.2 to before 1.18.1 Fixed in 1.18.1 Patch available CNA
  • github.com/oasdiff/oasdiff (Go) Vendor— Affected 1.13.2 to before 1.18.1 Fixed in 1.18.1 Patch available GHSA-2jcc-mxv7-p3f9

Remediation

  • Fix · CNA oasdiff (oasdiff) Fixed in 1.18.1
  • Fix · GHSA-2jcc-mxv7-p3f9 github.com/oasdiff/oasdiff (Go) Fixed in 1.18.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53508
  2. 2026-10-03 Alias added: GHSA-2jcc-mxv7-p3f9
  3. 2026-11-07 Affected versions changed · Red Hat
  4. 2026-11-07 CVSS score added · Red Hat

References

Other 5

  • TI-2026-38581 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences