---
id: CVE-2023-46124
aliases:
  - GHSA-jq3w-9mgf-43m4
  - PYSEC-2026-1344
title: Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
summary: Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L'
vendor: ethyca-fides
product: ethyca-fides
ecosystem: pip
affected:
  - ethyca-fides < 2.22.1
patched:
  - ethyca-fides 2.22.1
published: '2023-10-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:58.814711936Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jq3w-9mgf-43m4'
references:
  - url: 'https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-46124'
  - url: >-
      https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee
  - url: 'https://github.com/ethyca/fides'
  - url: 'https://github.com/ethyca/fides/releases/tag/2.22.1'
tags:
  - osv
  - pip
epss: 0.00675
epssPercentile: 0.5081
ingestedAt: '2026-07-08T18:25:50.851Z'
---

## Overview

### Impact

The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. 

It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources.

Exploitation is limited to API clients with the `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role.

### Patches
The vulnerability has been patched in Fides version `2.22.1`. Users are advised to upgrade to this version or later to secure their systems against this threat.

### Workarounds
There are no workarounds.


## Affected packages

- `ethyca-fides < 2.22.1`

## Remediation

Upgrade to a patched release:

- `ethyca-fides 2.22.1`