CVE-2026-28677 OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access

High 8.2 Published 6 Mar 2026 Updated 6 Mar 2026

Attackers can exploit insufficient URL restrictions in the ingest flow to access internal resources via SSRF in OpenSift deployments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-28677?

CVE-2026-28677 is a high-severity server-side request forgery vulnerability in OpenSift, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.

Weakness: CWE-918

Which versions are affected by CVE-2026-28677?

It affects 1 product.

Products include Opensift Opensift.

How do I fix CVE-2026-28677?

No fix has been published for CVE-2026-28677 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-28677 being exploited?

There is no known exploitation of CVE-2026-28677 in the wild and no public exploit code.

Sources

Also known as GHSA-5jfc-p787-2mf9.