Live › vulnerability › CVE-2026-66090
Go to dashboardopenEQUELLA before 2026.1 parses item metadata XML with external entity resolution enabled. A user allowed to create items can send crafted XML to POST /api/item and have the server read files the service can access or make requests to internal addresses, including cloud metadata endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Self-hosted openEQUELLA instances older than 2026.1 where users can create items, since the flaw is reached through the item creation API. Instances where only trusted administrators can create items have a smaller exposure, but the service account's file access and network reach still matter. unknown whether sources list specific deployment types beyond this.
No product ranges from the sources yet.
2026.1; anything older is in scope.2026.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
This page as .md · .json · in your agent: get_signal("CVE-2026-66090")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.