CVE-2026-62282

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62282
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62282.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62282
Aliases
  • GHSA-ch3g-4xvr-674q
Published
2026-09-18T13:52:53Z
Modified
2026-09-19T03:47:22Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
Details

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests to hosts reachable from the OpenCVE server, including internal network resources, localhost interfaces, link-local addresses, and cloud metadata services, and retrieve information from reachable HTTP services. This issue is fixed in version 3.0.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62282.json"
}
References

Affected packages

Git / github.com/opencve/opencve

Affected ranges

Type
GIT
Repo
https://github.com/opencve/opencve
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
928943aa87ceac789061114159d74c2067cc6ae6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62282.json"