CVE-2026-27170
📋 TL;DR
OpenSift versions 1.1.2-alpha and below have a server-side request forgery (SSRF) vulnerability where URL ingest functionality can be tricked into fetching resources from internal/private networks. This allows attackers to probe or access internal services from the OpenSift host. Anyone using vulnerable OpenSift versions with URL ingest enabled is affected.
💻 Affected Systems
- OpenSift
📦 What is this software?
Opensift by Opensift
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network services through credential theft, data exfiltration, or lateral movement from the OpenSift host.
Likely Case
Internal network reconnaissance, metadata harvesting, and potential access to unauthenticated internal services.
If Mitigated
Limited to public internet resources only, with no access to internal systems.
🎯 Exploit Status
Simple SSRF attack requiring only URL submission capability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3-alpha
Vendor Advisory: https://github.com/OpenSift/OpenSift/security/advisories/GHSA-3w2r-hj5p-h6pp
Restart Required: Yes
Instructions:
1. Download v1.1.3-alpha from GitHub releases. 2. Stop OpenSift service. 3. Replace binary/files with patched version. 4. Restart OpenSift service.
🔧 Temporary Workarounds
Environment variable restriction
allSet OPENSIFT_ALLOW_PRIVATE_URLS=true to allow only trusted local exceptions with caution
export OPENSIFT_ALLOW_PRIVATE_URLS=true
🧯 If You Can't Patch
- Disable URL ingest functionality completely
- Implement network segmentation to isolate OpenSift from internal networks
🔍 How to Verify
Check if Vulnerable:
Check OpenSift version and compare to affected range (≤1.1.2-alpha)Check Version:
opensift --version or check package/installation metadataVerify Fix Applied:
Confirm version is 1.1.3-alpha or higher and test URL ingest with internal IP addresses📡 Detection & Monitoring
Log Indicators:
- Unusual URL fetch patterns
- Requests to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
- Multiple failed fetch attempts
Network Indicators:
- Outbound connections from OpenSift to internal services
- Unusual port scanning patterns from OpenSift host
SIEM Query:
source="opensift" AND (url="*10.*" OR url="*172.16.*" OR url="*192.168.*")