{"id":"CVE-2026-54735","aliases":["GHSA-4p3g-4hcj-wpvx"],"title":"prebid-server's request forgery vulnerability allows for possible host environment data extraction","summary":"prebid-server's request forgery vulnerability allows for possible host environment data extraction","severity":"critical","cvss":10,"cwe":["CWE-918"],"vendor":"prebid","product":"github.com/prebid/prebid-server/v4","ecosystem":"go","affected":["github.com/prebid/prebid-server/v4 < 4.4.0","github.com/prebid/prebid-server/v3 <= 3.30.0","github.com/prebid/prebid-server/v2 <= 2.32.0","github.com/prebid/prebid-server <= 0.275.0"],"patched":["github.com/prebid/prebid-server/v4 4.4.0"],"published":"2026-07-29","updated":"2026-07-29","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4p3g-4hcj-wpvx","references":[{"url":"https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx"},{"url":"https://github.com/prebid/prebid-server/pull/4802"},{"url":"https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3"},{"url":"https://github.com/prebid/prebid-server/releases/tag/v4.4.0"},{"url":"https://github.com/advisories/GHSA-4p3g-4hcj-wpvx"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-29T16:48:34.024Z","epss":0.00345,"epssPercentile":0.28191,"slug":"CVE-2026-54735","body":"## Overview\n\n### Impact\nCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.\n\n### Patches\nPatched in [v4.4.0](https://github.com/prebid/prebid-server/releases/tag/v4.4.0)\n\n### Workarounds\nIf one is unable to update, please make sure that the affected bidder adapters are disabled.\n\n## Affected packages\n\n- `github.com/prebid/prebid-server/v4 < 4.4.0`\n- `github.com/prebid/prebid-server/v3 <= 3.30.0`\n- `github.com/prebid/prebid-server/v2 <= 2.32.0`\n- `github.com/prebid/prebid-server <= 0.275.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/prebid/prebid-server/v4 4.4.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}