[CRITICAL] cve-fix: Addressing SSRF CVE in Swagger UI endpoint - #1407
Merged
Merged
Conversation
adarshagrawal38
marked this pull request as ready for review
September 7, 2026 05:29
mayuka-c
reviewed
Sep 7, 2026
Member
|
@pranithraoibm ptal |
Member
|
@adarshagrawal38 let us just bump up the go-openapi/spec version for now. SSRF we will take care in coming days if needed. |
Signed-off-by: Adarsh Agrawal <adarsh.agrawal1@ibm.com>
adarshagrawal38
force-pushed
the
ctritical-cve
branch
from
September 12, 2026 15:18
94d87bf to
23b9258
Compare
yussufsh
approved these changes
Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: mitigate SSRF CVE in Swagger UI endpoint
What changed
router.go:34— two hardening changes to the/swagger/*anyroute:Spec URL locked to local —
ginSwagger.URL("/swagger/doc.json")is passed toWrapHandler, restricting the UI to only load the locally-served spec. This prevents the?url=query parameter from being overridden to an arbitrary address (including cloud metadata endpoints, private network addresses, or localhost services).Security context
github.com/go-openapi/spec(indirect dependency) has a known SSRF vulnerability: its default$refloader fetches any URL without restriction. The Swagger UI's free-form spec URL input was the exploitable entry point in this service. These changes close that vector without removing the UI.