CVE-2026-82040

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

CVE-2026-82040

UTMStack versions before 11.2.16 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the IdentityProviderService.validateMetadataUrl() function. Authenticated attackers can exploit the POST/PUT /api/identity-providers endpoint because the application fails to validate the...

PT-2026-104435

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An authenticated attacker can trigger a server-side request forgery SSRF by providing a malicious metadata URL to the POST/PUT /api/identity-providers endpoint. This occurs because the...