CVE-2026-54885 malach-it CVE debrief

Who should care

Defenders responsible for OAuth/OpenID authorization servers using malach-it Boruta, especially those with exposure to internal services or cloud metadata endpoints, should assess their exposure and prioritize remediation.

Why it matters

CVE-2026-54885 is a Server-Side Request Forgery vulnerability in malach-it Boruta that allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs. Defenders should prioritize verifying exposure, especially if using Boruta for OAuth/OpenID authorization, and implement additional security measures to restrict requestable URIs.

• Potential unauthorized access to internal services or cloud metadata endpoints.
• Possible data breaches or unauthorized data modifications.
• Risk of service disruption or denial of service.
• Need for verification of Boruta version and exposure to potential attacks.

Technical summary

The vulnerability exists in three code paths of the malach-it Boruta OAuth/OpenID authorization server: Boruta.Oauth.Request.Base.fetch_unsigned_request/1, Boruta.Openid.parse_registration_params/2, and Boruta.Ecto.Clients.refresh_jwk_from_jwks_uri/1. These paths allow an attacker to steer the server's HTTP client at arbitrary network targets reachable from the Boruta host, as they do not enforce sufficient validation of the target URIs.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using Boruta for OAuth/OpenID authorization. Immediate actions include updating to version 2.3.7 or later and implementing additional security measures to restrict the URIs that can be requested by the server.

Recommended defensive actions

• Verify if the Boruta version is within the affected range (from 2.3.2 before 2.3.7) and update to version 2.3.7 or later if necessary.
• Implement additional security measures to restrict the URIs that can be requested by the server, such as whitelisting allowed URIs or enforcing HTTPS.
• Monitor the server's HTTP client activity for suspicious requests that could indicate exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source references provide details about the vulnerability, including its description, affected versions, and potential impacts. However, there is limited information about actual exploitation or specific attacks. The NVD entry is currently Deferred.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.