CVE-2026-28329— SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
Quick assessment
Affected
SolarWinds SolarWinds Observability Self-Hosted
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SolarWinds Observability Self-Hosted 被发现存在服务端请求伪造（SSRF）漏洞，该漏洞允许已认证的攻击者诱使应用服务器向攻击者控制的目标或内部目的地发送请求。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28329
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
Source: CVE Program / CVE List V5
Vulnerability Description
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | SolarWinds Observability Self-Hosted | 2026.2.3 and all previous versions | - |
|
II. Public POCs for CVE-2026-28329
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28329
请登录查看更多情报信息。
Other References for CVE-2026-28329 (2)
Same Patch Batch · SolarWinds · 2026-10-20 · 4 CVEs total
| CVE-2026-28328 | 8.8 HIGH | SolarWinds Observability Self-Hosted broken authorization schema |
| CVE-2026-28330 | 4.6 MEDIUM | SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability |
| CVE-2026-28331 | 4.4 MEDIUM | SolarWinds Patch Manager Sensitive Information Exposure Vulnerability |
IV. Related Vulnerabilities
Same product: SolarWinds Observability Self-Hosted
-
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu -
CVE-2026-28328
SolarWinds Observability Self-Hosted broken authorization sc -
CVE-2026-28298
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip -
CVE-2026-28297
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip -
CVE-2025-40545
SolarWinds Observability Self-Hosted Open Redirection Vulner
Same vendor: SolarWinds
-
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu -
CVE-2026-28328
SolarWinds Observability Self-Hosted broken authorization sc -
CVE-2026-28331
SolarWinds Patch Manager Sensitive Information Exposure Vuln -
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-28324
SolarWinds Observability Self-Hosted Remote Code Execution V
Same weakness: CWE-918
-
CVE-2026-113671
ApostropheCMS: Host header controls server-side image fetch -
CVE-2026-111761
A2A Java SDK has Server-Side Request Forgery (SSRF) in push- -
CVE-2026-105941
Kroxylicious-kms-provider-azure-key-vault-kms: streams for a -
CVE-2026-107597
jwks_uri from the OIDC discovery document is fetched without -
CVE-2026-112237
Server-Side Request Forgery in extension "Kitodo.Presentatio
V. Comments for CVE-2026-28329
No comments yet