Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90486

openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery

CVSS 4.0 5.3 MEDIUMCVSS 3.1 6.3 MEDIUMCVSS 3.0 6.3 MEDIUMCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90486

Published

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90486

Published

openstatus

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "openstatusHQ",
                    "product": "openstatus",
                    "versions": [
                        {
                            "version": "f04c827112f30a11d571ebdad3892826034d6265",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:openstatushq:openstatus:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON