Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Apache OFBiz allows low‑privilege SSRF via content feature

CVE-2026-29226 · published 5 months ago
Summary

The content module in Apache OFBiz versions before 24.09.06 can be tricked into making requests to internal network resources, potentially exposing sensitive data. This can be done by users with limited permissions, so it may affect internal systems that rely on OFBiz for business processes. Upgrade to OFBiz 24.09.06 or later to close the gap.

What to do
  • Update apache ofbiz to version 24.09.06 or later.
Affected software
VendorProductAffected versions
apache ofbiz < 24.09.06
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Original advisory text
Apache OFBiz: Low-Privilege SSRF in Content Component
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published19 May 2026
Updated30 Oct 2026
First seen19 May 2026
Sources
CVE-2026-29226 · NVD
CVE-2026-29226 · OSV
Track software like this
Free during beta