CVE-2026-54735

Summary

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Severity

critical

CVSS

10

EPSS

0.6% (p49)

CWE

CWE-918

Also known as

GHSA-4p3g-4hcj-wpvx#github.com/prebid/prebid-server/v4

Published

2026-07-29

Updated

2026-07-29

Advisory details

Impact

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Patches

Patched in v4.4.0

Workarounds

If one is unable to update, please make sure that the affected bidder adapters are disabled.

References

• https://github.com/advisories/GHSA-4p3g-4hcj-wpvx
• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0

Related advisories

• CVE-2026-77524 — critical · Go/github.com/kedacore/keda
• GHSA-jqmf-mx4f-hfr6 — critical · PyPI/vibe-trading-ai
• CVE-2026-61559 — critical · npm/@zereight/mcp-gitlab
• CVE-2026-75856 — critical · crates.io/deepseek-tui
• CVE-2026-71428 — critical · PyPI/unstructured
• CVE-2026-64849 — critical · PyPI/mlflow
• CVE-2026-73080 — critical · Go/github.com/seaweedfs/seaweedfs
• CVE-2026-54725 — critical · Go/github.com/bank-vaults/vault-secrets-webhook

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity