{"action":"Upgrade edx-enterprise to 7.0.5 or later.","affected":[{"fixed":"7.0.5","introduced":"7.0.2"}],"component":"edx-enterprise","cve_ids":["CVE-2026-42860"],"ecosystem":"PyPI","epss":0.00299,"exploited":false,"fixed_versions":["7.0.5"],"ghsa_id":"GHSA-64cv-vxpr-j6vc","id":"tcs_01M5KF2D1E3D52KDJVCAP4E61D","modified_at":"2026-06-06T00:45:49.484678989Z","published_at":"2026-05-05T17:51:50Z","references":["https://osv.dev/vulnerability/GHSA-64cv-vxpr-j6vc","https://github.com/openedx/edx-enterprise/security/advisories/GHSA-64cv-vxpr-j6vc","https://nvd.nist.gov/vuln/detail/CVE-2026-42860","https://github.com/openedx/edx-enterprise","https://github.com/pypa/advisory-database/tree/main/vulns/edx-enterprise/PYSEC-2026-58.yaml"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-64cv-vxpr-j6vc","url":"https://osv.dev/vulnerability/GHSA-64cv-vxpr-j6vc"}],"summary":"edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint"}