CVE-2026-58301— Apache Shiro: Server-side POST request may be steered to an alternate host
Quick assessment
Affected
Apache Software Foundation Apache Shiro
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Ap
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58301
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Shiro: Server-side POST request may be steered to an alternate host
Source: CVE Program / CVE List V5
Vulnerability Description
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module.
Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. +
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:L/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Shiro | 2.0.0-alpha-0 ~ 3.0.0 | - |
|
II. Public POCs for CVE-2026-58301
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58301
请登录查看更多情报信息。
Other References for CVE-2026-58301 (1)
IV. Related Vulnerabilities
Same product: Apache Shiro
-
CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration -
CVE-2026-56130
Apache Shiro: Remember-me cookie isn't checked for expiry on -
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm -
CVE-2026-48589
Apache Shiro: Jakarta EE open redirect via untrusted Referer -
CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies
Same vendor: Apache Software Foundation
-
CVE-2026-74848
Apache APISIX: Cross-user response poisoning in serverless p -
CVE-2026-75005
Apache APISIX: Unauthenticated CPU-exhaustion DoS -
CVE-2026-75020
Apache APISIX: ldap-auth plugin cross-subtree identity imper -
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-s -
CVE-2026-73180
Apache Tomcat: Authenticated WebSocket session survives end
Same weakness: CWE-918
-
CVE-2026-82630
PowerJob Transport Endpoint TestController.java MuConnection -
CVE-2026-82556
Forgejo Repository Migration is_migrate_allowed.go net.Looku -
CVE-2026-82638
jina-ai reader Server-Side Request Forgery via disabled priv -
CVE-2026-82476
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range -
CVE-2026-82477
MITRE SAF Heimdall 2.11.6至2.13.x SSRF漏洞
V. Comments for CVE-2026-58301
No comments yet