PyPI/edx-enterprise CVE-2026-42860: high 8.5, EPSS 0.30%
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
Action: Upgrade edx-enterprise to 7.0.5 or later.
pip install edx-enterprise==7.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.2 | 7.0.5 | - |
Fixed versions
| 7.0.5 |
Sources
- osv: GHSA-64cv-vxpr-j6vc
- https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc
- https://nvd.nist.gov/vuln/detail/CVE-2026-42860
- https://github.com/openedx/edx-enterprise
- https://github.com/pypa/advisory-database/tree/main/vulns/edx-enterprise/PYSEC-2026-58.yaml
CVE-2026-42860 · published · modified · JSON