High, CVSS 8.5PyPIAmendedPublished
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
CVE-2026-42860 · GHSA-64cv-vxpr-j6vc
- Affected
- PyPI edx-enterprise >= 7.0.2, <= 7.0.4
- Fixed in
- 7.0.5· Vendor fix available
- Issue
- The syncproviderdata endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadatasource. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling syncproviderdata. The fetch in fetchmetadataxml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability was introduced when the SAML admin viewsets were migrated from openedx-platform into edx-enterprise. A related fix for the equivalent fetch path in openedx-platform (the fetchsamlmetadata Celery task) was applied in GHSA-328g-7h4g-r2m9. Details Vulnerable code path: enterprise/api/v1/views/samlutils.py: enterprise/api/v1/views/samlproviderdata.py: Missing protections: - No HTTPS enforcement (HTTP is allowed; the warning is not enforced) - No blocking of loopback (127.0.0.0/8) or link-local…
Recommended action: Upgrade to 7.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.