External risk intelligence

Prebid Server SSRF Vulnerability Allows Internal Network Access

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-54735

Prebid Server is designed to handle real-time advertising auctions, a function that typically operates as a public-facing API or service endpoint to communicate with various external bidders and ad exchanges across the internet.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Prebid Server, an open-source system for managing online advertising auctions. The issue allows specially crafted requests to redirect server-side communications to unintended locations, potentially exposing internal systems or sensitive data. The main concern is confirming relevance and exposure of this critical vulnerability.

Crafted requests can send server data elsewhere.
Critical issue impacts public-facing ad auction services.
Verify if your ad auction technology is affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted bid requests to a vulnerable Prebid Server instance. These requests would trick the server into making outbound requests to unintended internal or external destinations, potentially revealing sensitive information or services.

Publicly accessible endpoint.
User-supplied parameters in bid requests.
Server-side request forgery and data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to send requests to unintended destinations by crafting specific bid request parameters. When supported by the advisory, this could lead to the exposure of internal network services or sensitive server endpoints.

Internal network services or endpoints at risk.
Crafted parameters could redirect requests.
Potential exposure of internal services.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Prebid Server's open-source nature suggests that application owners or platform teams managing the advertising technology stack are likely responsible for this vulnerability. The first practical step involves identifying all instances of Prebid Server, assessing their internet-facing exposure, and confirming reachability to the public internet. Following this, accountable owners should be identified to initiate a risk-based remediation plan, which may involve coordination with vendors if Prebid Server is a third-party service.

Application owners should confirm vulnerable instances.
Verify external reachability and critical business impact.
Plan vendor coordination and controlled upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Prebid Server?

Prebid Server is an open-source software solution used by publishers and ad tech companies to conduct real-time advertising auctions in the cloud. It acts as a central hub that communicates with numerous external bidders and ad exchanges to determine which advertisements to display on websites or mobile apps. By consolidating these requests, it optimizes the auction process for digital advertising.

What does CVE-2026-54735 mean for the server?

This vulnerability is classified as Server-Side Request Forgery (SSRF), identified as CWE-918. It occurs because certain components of the software fail to validate host and subdomain information provided in bid requests. Consequently, the server can be tricked into initiating unauthorized outbound requests to unintended destinations, effectively using the server as a proxy to reach internal network resources or restricted endpoints.

How can an attacker trigger this bug?

An attacker triggers the vulnerability by submitting a bid request containing specially crafted parameters. These malicious inputs manipulate the server's request logic to target internal or unauthorized addresses. Notably, legitimate traffic that adheres to expected bidding protocols and contains validated, safe parameter values does not trigger this unintended redirection.

Is my Prebid Server instance at risk?

According to Halo Surface Signal, Prebid Server typically functions as a public-facing service to facilitate communication with external ad exchanges, making it inherently internet-facing. If your instance is reachable from the public internet and uses a version prior to 4.4.0, it is susceptible to being used to probe internal network services or access sensitive endpoints that should remain private.

What should I do to address this issue?

Your first step is to identify all deployed instances of Prebid Server within your infrastructure and confirm their current version. For any instance running a version older than 4.4.0, initiate an upgrade to version 4.4.0 or later, as this release contains the necessary fixes for the request validation logic. Coordinate with your platform teams to ensure these updates are applied to all environment instances.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.