CVE-2026-42860 Details
Description
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
A server-side request forgery (SSRF) vulnerability has been identified in the Open edX Enterprise Service app, specifically in versions 7.0.2 prior to 7.0.4. The issue arises in the sync_provider_data endpoint of the SAMLProviderDataViewSet, where SAML metadata is fetched from a URL specified in the SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can manipulate this field to point to an arbitrary URL, which is then accessed by the server without proper validation or security measures. This vulnerability allows for unauthorized outbound HTTP requests, potentially leading to exposure of internal services or cloud metadata.
Users are advised to update to Open edX Enterprise Service version 7.0.5, where this vulnerability has been fixed. Additionally, operators should enforce network-level egress filtering to block outbound connections from the Open edX server to link-local and private IP ranges, particularly for hostname-based URLs that cannot be validated at the application layer.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openedx edx-enterprise | >= 7.0.2, < 7.0.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |