CVE-2026-66090 Details
Description
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
A vulnerability exists in openEQUELLA versions prior to 2026.1.0, where the XML parser for item metadata fails to disable external entity resolution. This flaw allows users with permission to create items to submit manipulated XML that the server will process, potentially leading to the reading of arbitrary files accessible to the openEQUELLA service or making requests to attacker-specified locations. Such server-side requests could include calls to cloud instance metadata services, which may expose sensitive information like cloud credentials.
Users are advised to upgrade to openEQUELLA version 2026.1.0 or later, where this vulnerability has been addressed. After upgrading, no additional configuration changes are necessary. For those unable to upgrade immediately, it is recommended to implement a web application firewall or reverse proxy to block requests to the item REST API that contain DOCTYPE or ENTITY declarations. Additionally, review user permissions for creating or editing items, run openEQUELLA under a non-root account with limited file access, and restrict outbound network access from the openEQUELLA server, particularly to cloud metadata services.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96 | MON-CSIRT | AdvisoryRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | < 2026.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |