CVE-2026-42858

Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.

• CWE-918

• https://github.com/openedx/openedx-platform/commit/6fda1f120ff5a590d120ae1180185525f399c6d0Patch
• https://github.com/openedx/openedx-platform/commit/70a56246dd9c9df57c596e64bdd8a11b1d9da054Patch
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9Exploit, Vendor Advisory
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-328g-7h4g-r2m9Exploit, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42851Kitty is a cross-platform GPU based terminal. In versions pr…7.8
• CVE-2026-42853ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-42854arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…9.8
• CVE-2026-42855arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…7.5
• CVE-2026-42856Network-AI is a TypeScript/Node.js multi-agent orchestrator.…8.7
• CVE-2026-42857Open edX Platform enables the authoring and delivery of onli…5.4
• CVE-2026-42859Neat VNC is a VNC server library. Prior to 0.9.6, a pre-auth…8.1
• CVE-2026-4286Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…4.3
• CVE-2026-42860The Open edx Enterprise Service app provides enterprise feat…8.5
• CVE-2026-42861Flowise is a drag & drop user interface to build a customize…9.6
• CVE-2026-42862Flowise is a drag & drop user interface to build a customize…5
• CVE-2026-42863Flowise is a drag & drop user interface to build a customize…8.1