What is the CVSS score of CVE-2026-29226?

CVE-2026-29226 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Apache OFBiz are affected by CVE-2026-29226?

Apache OFBiz versions before 24.09.06 contain an unauthenticated server-side request forgery flaw that allows external attackers to access internal systems and steal cloud credentials.. A patch is available.

How to fix or mitigate CVE-2026-29226?

Within 24 hours: Identify all Apache OFBiz deployments, document current versions, and prioritize those exposed to the internet or running in cloud environments. Within 7 days: Upgrade all production Apache OFBiz instances to version 24.09.06 or later, starting with systems that access sensitive data or cloud infrastructure. Within 30 days: Complete upgrade of all remaining OFBiz installations across development, staging, and legacy environments to ensure complete patch coverage.

Apache OFBiz CVE-2026-29226

EUVD-2026-30858 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-19 apache

GHSA-ppv4-wf78-868j

Apache SSRF Apache Ofbiz Apache Software Foundation

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-reachable Content endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); SSRF yields partial internal read/request forgery, so C:L/I:L/A:L with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:55 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:19 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:19 cve.org

HIGH 7.3

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server into issuing arbitrary outbound requests through the Content component's operations. Exploitation can reach internal-only services, cloud metadata endpoints, and other network resources not otherwise accessible, with partial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low (0.02%).

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) suite built on Java, providing e-commerce, CRM, accounting, inventory, and content management functionality. The affected surface is the Content component, which handles document/content operations and evidently accepts a URL or resource reference that the server dereferences without adequate validation. The root cause is CWE-918 (Server-Side Request Forgery): the application fetches a remote resource using a user-influenced destination, allowing an attacker to redirect that request to unintended internal or external endpoints. The CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz identifies all OFBiz versions prior to the fixed 24.09.06 release as affected.

RemediationAI

Vendor-released patch: upgrade to Apache OFBiz 24.09.06, which fixes the issue, as directed by the Apache advisory at https://lists.apache.org/thread/6707wys8jxzmowxggn4cmtwwk9ygl2tr. Until the upgrade is applied, restrict network access to the OFBiz Content component endpoints and place the server behind egress filtering so that outbound requests from the application host cannot reach internal management interfaces, cloud metadata services (e.g. 169.254.169.254), or other sensitive internal ranges - the trade-off is that legitimate content operations that fetch external resources may break. Additionally consider requiring authentication or a reverse-proxy allowlist in front of Content component operations, accepting that this may disrupt anonymous content workflows. Cross-reference the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/05/19/16 for disclosure context.