CVE-2026-42858
HighSummary
A vulnerability in the Open edX platform allows authenticated Enterprise Admin users to supply any URL via the metadata_url POST parameter. This URL is passed directly without validation, enabling an attacker to force the server to make HTTP requests to internal network services or malicious endpoints.
Risk Assessment
An attacker with Enterprise Admin privileges can exploit this vulnerability to access sensitive data on the internal network or conduct attacks on other systems. This could lead to serious security breaches within the organization.
Recommendation
It is recommended to update the Open edX platform to the latest version to mitigate this vulnerability. Additionally, implementing further URL validation controls in the application is advisable.
Other vulnerabilities in Open edX Platform
See all- CVE-2026-35404Medium
The Open edX Platform before commit 76462f1e5fa9b37d2621ad7ad19514b403908970 contains an open redirect vulnerability in the view_survey endpoint. The redirect_url parameter is not validated, allowing attackers to redirect authenticated users to malicious sites and perform phishing and credential theft.
- CVE-2026-34736Medium
In Open edX Platform from the maple release to ulmo, an unauthenticated attacker can fully bypass the email verification process. This exploits OAuth2 tokens issued to inactive users and the exposure of activation_key in the REST API response.
Original NVD description (English source)
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.