CVE-2026-28677 Details

A server-side request forgery (SSRF) vulnerability has been identified in OpenSift, an AI study tool, prior to version 1.6.3-alpha. The issue arises in the URL ingestion pipeline, which accepted user-controlled remote URLs without sufficient destination restrictions. While checks for private or local host URLs were in place, the absence of restrictions for credentialed URLs, non-standard ports, and cross-host redirects created potential abuse paths in non-localhost deployments. This vulnerability could allow an attacker to send requests to unintended internal endpoints.

Users are advised to update to OpenSift version 1.6.3-alpha or later, and to disable URL ingestion for untrusted users. If possible, keep the deployment localhost-only or behind strict trusted proxy controls.