CVE-2026-9557 Mautic Focus component Vulnerable to SSRF
Authenticated users can exploit insufficient URL validation in Mautic's Focus component to perform Server-Side Request Forgery, enabling internal network reconnaissance.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9557?
CVE-2026-9557 is a medium-severity server-side request forgery vulnerability in mautic/core, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.
Weakness: CWE-918
Which versions are affected by CVE-2026-9557?
8 open source packages ship an affected version, including mautic/core.
| Package | Affected | Fixed in |
|---|---|---|
mautic/core Packagist | From 4.0.0 to 4.4.13 | None |
mautic/core Packagist | From 4.0.0 to 4.4.13 | None |
mautic/core Packagist | From 5.0.0 | 5.2.11 |
mautic/core Packagist | From 5.0.0 | 5.2.11 |
mautic/core Packagist | From 6.0.0 | 6.0.9 |
mautic/core Packagist | From 6.0.0 | 6.0.9 |
2 more packages
mautic/core Packagist | From 7.0.0 | 7.1.2 |
mautic/core Packagist | From 7.0.0 | 7.1.2 |
How do I fix CVE-2026-9557?
Upgrade mautic/core to a fixed version for your release line: 5.2.11, 6.0.9 or 7.1.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-9557 being exploited?
There is no known exploitation of CVE-2026-9557 in the wild and no public exploit code.
Sources
Also known as GHSA-jmv8-8j9j-rcpc.