prebid-server's request forgery vulnerability allows for possible host environment data extraction

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54735 · Microsoft / collected KEV context

GHSA-4p3g-4hcj-wpvx

GO-2026-6139

cve-program · CVE-2026-54735

• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0

nvd · CVE-2026-54735

• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0
• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx

osv · GHSA-4p3g-4hcj-wpvx

• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0

osv · GO-2026-6139

• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0

No related operational record is retained in the current change model.