Live › vulnerability › CVE-2026-66089
Go to dashboardopenEQUELLA before 2026.1 parses XML sent to its SOAP stopEdit operation with an XML parser that resolves external entities. An attacker can read files the openEQUELLA service can access and make the server send requests to addresses of their choosing (SSRF).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Teams running openEQUELLA before 2026.1 with the SOAP API exposed to users or networks that should not reach it. Deployments where the SOAP API is not reachable from untrusted networks have less exposure. The sources do not say whether authentication is required for stopEdit.
No product ranges from the sources yet.
2026.1; anything older is in scope.2026.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
This page as .md · .json · in your agent: get_signal("CVE-2026-66089")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.