CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
oasdiff fails to enforce external reference restrictions when loading specs from git revisions, allowing attackers to read local files or trigger SSRF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53508?
CVE-2026-53508 is a medium-severity server-side request forgery vulnerability in oasdiff, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.
Which versions are affected by CVE-2026-53508?
3 open source packages ship an affected version, including github.com/oasdiff/oasdiff.
| Package | Affected | Fixed in |
|---|---|---|
github.com/oasdiff/oasdiff Go | From 1.13.2 | 1.18.1 |
github.com/oasdiff/oasdiff Go | From 1.13.2 | 1.18.1 |
github.com/oasdiff/oasdiff Go | From 1.13.2 | 1.18.1 |
How do I fix CVE-2026-53508?
Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-53508 being exploited?
There is no known exploitation of CVE-2026-53508 in the wild and no public exploit code.
Sources
Also known as GHSA-2jcc-mxv7-p3f9, GO-2026-5937.