CVE-2023-46124
highpriority · track · 29EPSS 0.008 · 58 %ileEUUSEPSS · scored 2026-10-27
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-jq3w-9mgf-43m4Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload2023-10-24ghsa · osvUS
### Impact The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. Exploitation is limited to API clients with the `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role. ### Patches The vulnerability has been patched in Fides version `2.22.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. ### Workarounds There are no workarounds.
- PYSEC-2026-1344Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload2026-07-07vendor · osvUS
### Impact The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. Exploitation is limited to API clients with the `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role. ### Patches The vulnerability has been patched in Fides version `2.22.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. ### Workarounds There are no workarounds.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-46124/cnnvd
- https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1eecnnvd
- https://github.com/ethyca/fides/releases/tag/2.22.1cnnvd
- https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4cnnvd
- https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1eeenisa_euvd
- https://github.com/ethyca/fides/releases/tag/2.22.1enisa_euvd
- https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4enisa_euvd
- https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1eePatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan