Which versions of Pandora FMS are affected by CVE-2026-30810?

Pandora FMS versions 777-800 contain a server-side request forgery vulnerability in the API Checker extension that allows authenticated attackers to force the server to make unauthorized requests to…

How to fix or mitigate CVE-2026-30810?

Within 24 hours: Identify all Pandora FMS instances running versions 777-800 and document their network location and data sensitivity. Within 7 days: Implement network segmentation to restrict Pandora FMS server outbound connections to only required endpoints; disable or restrict the API Checker extension if operationally feasible. Within 30 days: Contact Pandora FMS vendor for patch availability timeline; prepare for immediate deployment of patched version when released by vendor.

Pandora FMS CVE-2026-30810

Q: What is the CVSS score of CVE-2026-30810?

CVE-2026-30810 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-29497 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-12 PandoraFMS

GHSA-xvxp-pj7j-gmjj

Privilege Escalation SSRF Pandora Fms

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:33 vuln.today

CVSS changed

May 12, 2026 - 16:22 NVD

7.1 (HIGH)

CVE Published

May 12, 2026 - 15:12 nvd

HIGH 7.1

DescriptionCVE.org

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800

AnalysisAI

Server-Side Request Forgery (SSRF) in Pandora FMS versions 777-800 enables authenticated attackers to escalate privileges through the API Checker extension. Attackers with low-privilege network access can force the server to make arbitrary requests, potentially accessing internal resources and escalating to higher confidentiality impact (CVSS VC:H). EPSS data not available; no confirmed active exploitation (not in CISA KEV). Vendor has acknowledged the issue per PandoraFMS security advisory, indicating patch development is likely underway.

Technical ContextAI

This vulnerability affects the API Checker extension in Pandora FMS (Flexible Monitoring System), an enterprise monitoring platform. The flaw is classified as CWE-918 (Server-Side Request Forgery), where insufficient validation allows authenticated users to manipulate server-side HTTP requests. The SSRF occurs when the API Checker extension fails to properly sanitize or restrict target URLs, enabling attackers to abuse the server's trust relationships to access internal services, cloud metadata endpoints (e.g., AWS IMDSv1), or bypass network segmentation. The CPE string (cpe:2.3:a:pandora_fms:pandora_fms:*:*:*:*:*:*:*:*) indicates all deployment types across versions 777-800 are vulnerable, representing approximately 23 version releases of the platform.

RemediationAI

Consult the official Pandora FMS security advisory at https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ for patch availability and specific remediation guidance. Vendor-released patch availability not independently confirmed from available data - contact Pandora FMS support for update timeline to versions beyond 800. Immediate compensating controls: (1) Restrict network access to the API Checker extension interface to trusted administrator IPs only via firewall rules or reverse proxy ACLs, reducing attack surface but limiting legitimate remote administration capabilities. (2) Implement egress filtering on the Pandora FMS server to block outbound requests to RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254) - this prevents internal reconnaissance but may break legitimate monitoring of internal APIs if API Checker is used for that purpose. (3) Review and reduce privileges of Pandora FMS user accounts to minimum necessary, limiting the population of PR:L accounts that can exploit the vulnerability. (4) Enable detailed logging for API Checker extension usage and monitor for unusual destination URLs or high-frequency requests indicating exploitation attempts.