Homepage

Server-Side Request Forgery (SSRF) The advisory has been revoked - it doesn't affect any version of package openshift-kube-controller-manager  (opens in a new tab)

Threat Intelligence

EPSS
0.21% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-OPENSHIFTKUBECONTROLLERMANAGER-19491109
  • published2 Sept 2026
  • disclosed30 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 30 Aug 2026

NewCVE-2026-82556  (opens in a new tab)
CWE-918  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openshift-kube-controller-manager package and not the openshift-kube-controller-manager package as distributed by RHEL.

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change."