EUVD-2026-56282
GHSA-47fm-r9j8-2g49
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Scope changes to internal services (S:C); SSRF inherently yields at least low confidentiality impact from internal response data, so C:N is understated.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
AnalysisAI
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) occurs when an application fetches a remote resource based on a user-supplied URL without sufficient validation, allowing an attacker to redirect server-side requests to internal infrastructure. The Content Credentials ecosystem (built on the C2PA - Coalition for Content Provenance and Authenticity - standard) processes cryptographically signed media provenance metadata. The affected components span three distinct packages: the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), the Rust SDK (c2pa), and the command-line tool (c2patool). All three likely parse or dereference external URLs embedded in C2PA manifest data or as inputs to credential verification workflows, making the SSRF triggerable through maliciously crafted media or manifest URLs. The privilege escalation vector implied by the tags suggests that internal service requests made via SSRF may reach endpoints that trust the request origin and grant elevated capabilities.
RemediationAI
Update all affected components to their respective patched versions: c2pa Rust SDK to c2pa-v0.90.6, the JavaScript SDK to @contentauth/c2pa-web@0.12.1, and c2patool to c2patool-v0.27.6. Full details are available in Adobe Security Bulletin APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html and in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-47922. If immediate patching is not feasible, reduce exposure by restricting outbound network access from services that invoke the Content Credentials SDK, blocking connections to internal RFC-1918 addresses and metadata endpoints (e.g., cloud provider IMDS) from the process context running these libraries - note that aggressive egress filtering may break legitimate external manifest or credential resolution. Additionally, avoid processing untrusted C2PA manifests or user-supplied credential URLs in environments with privileged internal network access until patched versions are deployed.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today