What is the CVSS score of EUVD-2026-30194?

EUVD-2026-30194 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30194?

Yes, a patch is available for EUVD-2026-30194. Update the affected software to the latest version immediately.

ERPNext EUVD-2026-30194

| CVE-2026-44441 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-13 GitHub_M

SSRF Erpnext

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:14 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in ERPNext allows an authenticated remote attacker to send a crafted request to a vulnerable endpoint, causing the ERPNext server to issue arbitrary outbound HTTP calls to attacker-controlled services. The CVSS Changed scope (S:C) indicates the impact extends beyond the application itself, enabling potential access to internal network resources, cloud metadata services, or other intranet endpoints not otherwise reachable by the attacker. Vendor-released patches exist in versions 15.106.0 and 16.16.0; no active exploitation has been confirmed (not listed in CISA KEV) and EPSS sits at a very low 0.02%.

Technical ContextAI

ERPNext is an open-source ERP platform built on the Frappe framework (CPE: cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*). The root cause is CWE-918 (Server-Side Request Forgery), a class of vulnerability where user-supplied input influences the destination of a server-initiated HTTP request without adequate validation or allowlisting. The Changed scope in the CVSS vector (S:C) is architecturally significant: it indicates the vulnerable ERPNext component can be leveraged to affect resources outside its own authorization boundary - a hallmark of SSRF where the application server acts as an unintended proxy. In cloud-deployed ERPNext environments this is particularly impactful, as the instance metadata service (e.g., 169.254.169.254) and internal microservices may become accessible via forged server-side requests. The vulnerability was reported via GitHub Security Advisories (GHSA-m4m4-j2m2-7fcw) by reporter GitHub_M.

RemediationAI

Upgrade ERPNext to version 15.106.0 or later on the v15 branch, or to version 16.16.0 or later on the v16 branch - these are the vendor-confirmed fixed releases per the security advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-m4m4-j2m2-7fcw. If immediate patching is not feasible, apply network-level egress filtering on the ERPNext application server to block outbound requests to internal RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, fd00:ec2::254) - this does not eliminate the vulnerability but prevents the most damaging SSRF pivots. Additionally, restricting the application to only allow HTTP egress through an authenticated forward proxy with an explicit allowlist of permitted external destinations is a compensating control that survives reboots, though it may disrupt legitimate integrations and requires careful allowlist maintenance. Restrict the number of user accounts with access to the vulnerable endpoint where possible, given that PR:L privileges are required for exploitation.