CVE-2026-28680
Published: 06 March 2026
Summary
CVE-2026-28680 is a critical-severity SSRF (CWE-918) vulnerability in Ghostfol Ghostfolio. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-28680 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting Ghostfolio, an open source wealth management software. Prior to version 2.245.0, the manual asset import feature allows a full-read SSRF, enabling attackers to make unauthorized requests from the server. The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), indicating critical severity due to high confidentiality impact and changed scope.
A remote, unauthenticated attacker can exploit this vulnerability by abusing the manual asset import functionality to force the Ghostfolio server to send requests to arbitrary internal or external endpoints. Successful exploitation allows exfiltration of sensitive cloud metadata, such as Instance Metadata Service (IMDS) data, or probing of internal network services, potentially leading to further compromise in cloud environments.
The issue has been addressed in Ghostfolio version 2.245.0, as detailed in the project's release notes and security advisory. Security practitioners should upgrade to this version or later to mitigate the vulnerability, with further technical details available in the GitHub advisory (GHSA-hhv6-c34h-pwgh) and release tag (2.245.0).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9990
Vulnerability details
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This…
more
issue has been patched in version 2.245.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing app directly enables T1190 exploitation; facilitates internal service probing (T1046), cloud metadata API access (T1522), and IMDS credential exfiltration (T1552.005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates user-supplied inputs in the manual asset import feature to block malicious URLs that enable SSRF exploitation.
Enforces logical information flow control policies to prevent the server from making unauthorized requests to internal endpoints or cloud metadata services.
Monitors and controls application outbound network traffic at boundaries to block SSRF-induced requests to sensitive internal resources.