CVE-2026-42860 Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint
An authenticated Enterprise Admin can trigger server-side requests to arbitrary URLs via SAML metadata configuration, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42860?
CVE-2026-42860 is a high-severity server-side request forgery vulnerability in openedx edx-enterprise, published on 11 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
Weakness: CWE-918
Which versions are affected by CVE-2026-42860?
3 open source packages ship an affected version, including edx-enterprise. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
edx-enterprise PyPI | From 7.0.2 | 7.0.5 |
edx-enterprise PyPI | From 7.0.2 | 7.0.5 |
edx-enterprise PyPI | From 7.0.2 | 7.0.5 |
Products include Openedx Edx-Enterprise.
How do I fix CVE-2026-42860?
Upgrade edx-enterprise to 7.0.5 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-42860 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42860 exists.
Sources
Also known as GHSA-64cv-vxpr-j6vc, PYSEC-2026-58.