CVE-2026-42860
2 advisories.
PyPI/edx-enterprise CVE-2026-42860: high 8.5
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
Action: Upgrade edx-enterprise to 7.0.5 or later.
pip install edx-enterprise==7.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.2 | 7.0.5 | - |
Fixed versions
| 7.0.5 |
Sources
- osv: GHSA-64cv-vxpr-j6vc
- https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc
- https://nvd.nist.gov/vuln/detail/CVE-2026-42860
- https://github.com/openedx/edx-enterprise
- https://github.com/pypa/advisory-database/tree/main/vulns/edx-enterprise/PYSEC-2026-58.yaml
CVE-2026-42860 · published · modified · JSON
PyPI/edx-enterprise CVE-2026-42860: high 8.5
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a
Action: Upgrade edx-enterprise to 7.0.5 or later.
pip install edx-enterprise==7.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 7.0.2 | 7.0.5 | - |
Fixed versions
| 7.0.5 |
Sources
- osv: PYSEC-2026-58
- https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc
CVE-2026-42860 · published · modified · JSON