CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction
Attackers can exploit improper URL validation in bidder adapters to perform server-side request forgery, potentially exposing internal network services or sensitive endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54735?
CVE-2026-54735 is a critical server-side request forgery vulnerability in prebid-server, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-54735?
9 open source packages ship an affected version, including github.com/prebid/prebid-server/v4, github.com/prebid/prebid-server and github.com/prebid/prebid-server/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/prebid/prebid-server/v4 Go | All versions | 4.4.0 |
github.com/prebid/prebid-server/v4 Go | All versions | 4.4.0 |
github.com/prebid/prebid-server/v4 Go | All versions | 4.4.0 |
github.com/prebid/prebid-server Go | All versions to 0.275.0 | None |
github.com/prebid/prebid-server Go | All versions to 0.275.0 | None |
github.com/prebid/prebid-server/v2 Go | All versions to 2.32.0 | None |
3 more packages
github.com/prebid/prebid-server/v2 Go | All versions to 2.32.0 | None |
github.com/prebid/prebid-server/v3 Go | All versions to 3.30.0 | None |
github.com/prebid/prebid-server/v3 Go | All versions to 3.30.0 | None |
Products include Prebid Prebid Server.
How do I fix CVE-2026-54735?
Upgrade github.com/prebid/prebid-server/v4 to 4.4.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54735 being exploited?
There is no known exploitation of CVE-2026-54735 in the wild and no public exploit code.
Sources
Also known as GHSA-4p3g-4hcj-wpvx, GO-2026-6139.