---
id: "CVE-2026-107597"
kind: "vulnerability"
aliases: ["CVE-2026-107597"]
title: "PIA: token check fetches attacker-chosen URLs, enabling server-side request forgery"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["oidc", "other", "pia", "sbom-upload", "self-hosted"]
not_affected_if: ["single-trusted-issuer"]
published_at: "2026-10-20T11:17:15+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:29:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107597", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# PIA: token check fetches attacker-chosen URLs, enabling server-side request forgery

PIA's token verification follows a jwks_uri from an approved OIDC issuer's discovery document without checking it is a URL on that issuer or uses HTTPS. An approved identity provider, including any per-project Jenkins OIDC instance, can make PIA send GET requests to arbitrary hosts and ports from its own network position, before any signature check.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107597

## From the sources

PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_