CVE-2026-81829 Server-side request forgery in Exploit Intelligence
Unauthenticated attackers can force server-side requests to arbitrary same-origin paths via unsanitized JWT kid headers, potentially exposing internal data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81829?
CVE-2026-81829 is a medium-severity server-side request forgery vulnerability in Red Hat Exploit Intelligence, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.
Weakness: CWE-22
Which versions are affected by CVE-2026-81829?
How do I fix CVE-2026-81829?
No fix has been published for CVE-2026-81829 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-81829 being exploited?
There is no known exploitation of CVE-2026-81829 in the wild and no public exploit code.
Sources
Also known as GHSA-66cv-5wq4-p78m.