{"uuid": "a6cb391a-c63a-4f66-9610-0069d52e9e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84", "content": "# CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54735\n\n## Summary\nCVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.\n\n## TL;DR\nPrebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1**: 10.0 (Critical)\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure\n\n## Affected Systems\n\n- Prebid Server\n- **prebid-server**: < 4.4.0 (Fixed in: `4.4.0`)\n\n## Mitigation\n\n- Upgrade to Prebid Server version 4.4.0 or above\n- Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses\n- Implement DNS resolution filters inside the container network\n\n**Remediation Steps:**\n1. Identify all active Prebid Server instances and map their respective current versions\n2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer\n3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints\n4. Verify the mitigation using test payloads matching invalid-host structures\n\n## References\n\n- [GitHub Security Advisory GHSA-4p3g-4hcj-wpvx](https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T16:32:11.749626Z"}