What is the CVSS score of CVE-2026-28677?

CVE-2026-28677 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-28677?

Within 24 hours: Identify all OpenShift instances and document current versions in use; disable the URL ingest feature if business operations permit. Within 7 days: Implement network segmentation isolating OpenShift from sensitive internal systems and credential stores; deploy WAF rules blocking suspicious URL patterns to internal IP ranges and non-standard ports. Within 30 days: Upgrade to version 1.6.3-alpha or later when available; conduct audit of URL ingest logs for exploitation indicators and assess any potentially compromised data.

Opensift CVE-2026-28677

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-06 security-advisories@github.com

SSRF Opensift

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 05:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.

AnalysisAI

OpenSift versions prior to 1.6.3-alpha are vulnerable to server-side request forgery (SSRF) attacks through the URL ingest pipeline, which fails to properly validate credentialed URLs, non-standard ports, and cross-host redirects in non-localhost deployments. An unauthenticated remote attacker can exploit this to access internal resources and potentially exfiltrate sensitive data from the affected system. No patch is currently available for this vulnerability.

Technical ContextAI

This vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affects OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI.. OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.