GitHub Advisoryadvisory · Go

GHSA-4p3g-4hcj-wpvx prebid-server's request forgery vulnerability allows for possible host environment data extraction

CRITICAL Published 2026-07-29 Modified 2026-07-29 Official page ↗
Aliases
CVE-2026-54735
Ecosystem
Go
Packages
github.com/prebid/prebid-server/v4, github.com/prebid/prebid-server/v3, github.com/prebid/prebid-server/v2, github.com/prebid/prebid-server
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2026-07-29

Affected packages

• Go github.com/prebid/prebid-server/v4: < 4.4.0 → fixed in 4.4.0 • Go github.com/prebid/prebid-server/v3: <= 3.30.0 (no fix yet) • Go github.com/prebid/prebid-server/v2: <= 2.32.0 (no fix yet) • Go github.com/prebid/prebid-server: <= 0.275.0 (no fix yet)

Description

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. Patches Patched in v4.4.0 Workarounds If one is unable to update, please make sure that the affected bidder adapters are disabled.

Related

Alias · CVE (1)

  • CVE-2026-54735 Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References