Bug 2571819 (CVE-2026-126770) - CVE-2026-126770 rems: OpsTree REMS: Server-side request forgery via database Test Connection feature
Summary: CVE-2026-126770 rems: OpsTree REMS: Server-side request forgery via database ...
Keywords:
Status: NEW
Alias: CVE-2026-126770
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-11 18:21 UTC by OSIDB Bzimport
Modified: 2026-11-11 18:30 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-11 18:21:42 UTC 
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
Note You need to log in before you can comment on or make changes to this bug.