Open-source package vulnerability · Go

CVE-2026-54735: prebid-server's request forgery vulnerability allows for possible host environment data extraction

criticalCVSS 3.1 10.0GHSA-4p3g-4hcj-wpvx

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Published Jul 29, 2026

Affected packages

github.com/prebid/prebid-server/v4

Ecosystem: Go
Affected: < 4.4.0
Fixed in: 4.4.0
Check: go list -m github.com/prebid/prebid-server/v4

github.com/prebid/prebid-server/v3

Ecosystem: Go
Affected: <= 3.30.0
Fixed in: No patched version yet
Check: go list -m github.com/prebid/prebid-server/v3

github.com/prebid/prebid-server/v2

Ecosystem: Go
Affected: <= 2.32.0
Fixed in: No patched version yet
Check: go list -m github.com/prebid/prebid-server/v2

github.com/prebid/prebid-server

Ecosystem: Go
Affected: <= 0.275.0
Fixed in: No patched version yet
Check: go list -m github.com/prebid/prebid-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Patches

Patched in v4.4.0

Workarounds

If one is unable to update, please make sure that the affected bidder adapters are disabled.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology