CVE-2026-58301— Apache Shiro: Server-side POST request may be steered to an alternate host
Quick assessment
Affected
Apache Software Foundation Apache Shiro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Shiro是美国Apache基金会的一款身份认证与权限管理框架。 Apache Shiro 2.x版本至3.0.0版本存在服务端请求伪造漏洞，该漏洞源于服务端请求伪造问题，可能导致低权限用户构造HTTP请求，使服务器向攻击者控制的URL发起连接并传输数据。
Possible ATT&CK Techniques 3 AI
T1021 · Remote Services T1595 · Active Scanning T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Shiro | 2.0.0-alpha-0≤ 3.0.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58301
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Shiro: Server-side POST request may be steered to an alternate host
Source: CVE Program / CVE List V5
Vulnerability Description
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.
Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:L/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Shiro 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Shiro是美国Apache基金会的一款身份认证与权限管理框架。 Apache Shiro 2.x版本至3.0.0版本存在服务端请求伪造漏洞，该漏洞源于服务端请求伪造问题，可能导致低权限用户构造HTTP请求，使服务器向攻击者控制的URL发起连接并传输数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Shiro | 2.0.0-alpha-0 ~ 3.0.0 | - |
|
II. Public POCs for CVE-2026-58301
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58301
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-58301 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-31 · 10 CVEs total
| CVE-2026-76985 | 5.1 MEDIUM | Apache Wicket: XSS in Palette via getAdditionalAttributes |
| CVE-2026-76983 | 5.1 MEDIUM | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel |
| CVE-2026-76984 | 5.1 MEDIUM | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute |
| CVE-2026-76982 | 5.1 MEDIUM | Apache Wicket: XSS in Button via its model object |
| CVE-2026-75802 | 5.1 MEDIUM | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and default |
| CVE-2026-76986 | Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue | |
| CVE-2026-71378 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationReq | |
| CVE-2026-71257 | Apache Wicket: Configured file upload limits are not enforced when the multipart request h | |
| CVE-2026-70449 | Apache Wicket: Path traversal in resource style/variation/locale |
IV. Related Vulnerabilities
Same product: Apache Shiro
-
CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration -
CVE-2026-56130
Apache Shiro: Remember-me cookie isn't checked for expiry on -
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm -
CVE-2026-48589
Apache Shiro: Jakarta EE open redirect via untrusted Referer -
CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies
Same vendor: Apache Software Foundation
-
CVE-2026-86467
Apache Airflow Amazon provider: AWS auth manager: SAML login -
CVE-2026-88900
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of -
CVE-2026-91858
Apache Camel: Camel-FOP Resolves External DTDs and Entities -
CVE-2026-88901
Apache Camel: Camel-Smooks XML External Entity Processing, e -
CVE-2026-85317
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under
Same weakness: CWE-918
-
CVE-2026-8355
IBM ContextForge MCP Gateway is affected by server-side requ -
CVE-2026-112991
MISP html_to_markdown Module SSRF via Incomplete IP Range Bl -
CVE-2026-112358
TiBillet Lespass APIv1 serializers.py get_img_from_url serve -
CVE-2026-112299
smrealms smr Album Website AlbumEditProcessor.php isUrlReach -
CVE-2026-112297
ptbsare anx-calibre-manager LLM Configuration llm.py LLMClie
V. Comments for CVE-2026-58301
No comments yet