External risk intelligence

Open edX SAML SSRF via Unvalidated Metadata URL.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-42858

The vulnerability exists in an endpoint within an internet-accessible web application platform. While the application itself is typically internet-facing, this specific function requires authenticated Enterprise Admin privileges to execute, making the attack surface reachable but restricted to users with established administrative access within the deployment.

Server-Side Request Forgery

Openedx

before 2026-04-24

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Open edX Platform allows authenticated administrators to redirect the system to arbitrary URLs, potentially exposing internal network services or cloud metadata. This could enable unauthorized access to sensitive information.

Admin users can force internal server requests.
Matters if you use Open edX for online learning.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with Enterprise Admin privileges can exploit this vulnerability by submitting a crafted URL through the `metadata_url` parameter. The platform then passes this URL to an internal function without proper validation, causing the server to request data from the specified URL. This can lead to sensitive information disclosure or other risks depending on the target URL.

Requires Enterprise Admin authentication.
Submitting a malicious metadata URL.
Server-side request forgery.

Live Threat

Current exploitation, exposure, and threat context

An attacker with Enterprise Admin privileges could force the Open edX Platform server to make unvalidated HTTP requests to arbitrary URLs. This could expose internal network services or cloud metadata endpoints to the attacker when supported by the advisory.

Internal network services and cloud metadata endpoints.
Server makes unvalidated HTTP requests to attacker-controlled destinations.
Disclosure of sensitive network information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Open edX Platform, specifically the SAML provider data synchronization. The primary responsibility for addressing this likely falls to the platform or application ownership team, in coordination with the infrastructure and security teams. The first practical step is to identify all instances of the Open edX Platform, confirm their reachability and criticality, and then determine the accountable owner for each instance to plan remediation.

Identify affected instances and owners.
Verify enterprise admin access and reachability.
Plan remediation based on instance risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Open edX Platform?

Open edX is a large-scale, open-source software platform designed for hosting and managing online learning environments. It provides the infrastructure necessary for organizations to deliver educational courses, manage student data, and handle complex authentication workflows, such as SAML-based identity integration, which is where this specific issue resides.

How does CVE-2026-42858 work?

This vulnerability is a Server-Side Request Forgery (SSRF), categorized as CWE-918. It occurs when a web application accepts a user-provided URL but fails to validate it. In this case, the system takes an unverified address provided by an administrator and instructs the server to fetch data from it, allowing the server to be manipulated into communicating with unintended destinations.

When is this vulnerability triggered?

The flaw is triggered when an authenticated user with Enterprise Admin privileges submits a crafted URL to the `metadata_url` parameter. Simply navigating the site or using standard learner features does not trigger this. The action must specifically target the sync_provider_data endpoint, and the server must attempt to process the provided malicious URL as a metadata source.

Is my deployment relevant for this CVE?

According to Halo Surface Signal, relevance depends on your specific setup. While Open edX is often internet-facing, this vulnerability specifically requires the attacker to hold Enterprise Admin privileges. If your instance is internet-accessible, ensure your access control policies strictly limit who can hold these high-level administrative roles to mitigate the risk.

Do I need to patch my Open edX instance?

Yes. Start by identifying all active instances of the Open edX Platform within your organization and determining who manages each one. Once identified, coordinate with those teams to update your platform to a version that includes the necessary fixes for the SAML provider data synchronization process, as provided in the official security commits.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.