Skip to content
eastbaycyber

CVE-2026-54735: Prebid Server SSRF in Bidder Adapter URL Handling

CVE explainers 9 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-29
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Critical SSRF-style flaw in Prebid Server before 4.4.0. - User-controlled parameters can influence outbound requests to unintended destinations. - Upgrade to 4.4.0 immediately and restrict egress from Prebid infrastructure.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-54735
CVSS 10.0
Attack Vector Network
Privileges Required Unknown from the cited NVD summary; defenders should assume remote reachability where bid request input is attacker-influenced
Patch Available Yes, fixed in Prebid Server 4.4.0

CVE-2026-54735 is a critical server-side request forgery (SSRF)-style issue in Prebid Server, the open-source server-to-server header bidding platform from the Prebid project. According to the NVD description, the issue exists because certain bidder adapters interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values.

The practical risk is that an attacker may be able to cause the Prebid Server instance to send requests to destinations the application did not intend to contact. In environments where Prebid Server can reach internal APIs, administrative interfaces, or cloud metadata services, that can turn a malformed auction input into a path for internal reconnaissance or access to sensitive endpoints. A patch is available, and the fixed version is explicitly identified as 4.4.0.

What Is This Vulnerability?

At its core, this is an input validation failure in outbound URL construction. Certain bidder adapters in Prebid Server take request-derived values and use them as part of a destination URL. If hostnames or subdomains are not constrained to a safe allowlist or rigorously validated, attacker-controlled values can alter where the server sends HTTP requests.

That behavior matches the SSRF class of vulnerability, even if the exact request path depends on adapter logic. SSRF matters because the vulnerable server becomes a proxy under attacker influence. Instead of the attacker directly reaching an internal address or metadata endpoint, they induce the server to do it on their behalf. In modern cloud and containerized deployments, the server often has network paths the attacker does not.

Technical Notes

The NVD description states that “certain bidder adapters” interpolate “user-supplied parameters into outbound request URLs” without proper validation of “host and subdomain values.” That is sufficient to characterize the root cause as user-controlled URL component interpolation leading to unintended outbound connections.

A simplified pseudocode example of the dangerous pattern looks like this:

host := request.Params["host"]
subdomain := request.Params["subdomain"]
url := "https://" + subdomain + "." + host + "/auction"
resp, err := httpClient.Get(url)

If host or subdomain are not tightly validated, an attacker may be able to redirect the request to an unintended domain, internal service, or sensitive endpoint. The specific vulnerable adapters are not identified in the source material provided, so defenders should review all custom or forked adapter code that constructs outbound URLs from request parameters.

AnalystImpact · assess the risk

Who Is Affected?

The affected product is Prebid Server. Based on the cited NVD record, all versions prior to 4.4.0 are affected. The fixed version is Prebid Server 4.4.0. If you operate any deployment on 4.3.x or earlier, it should be treated as vulnerable unless you have independently backported the fix associated with the referenced commit and pull request.

This matters for both directly managed upstream deployments and downstream forks or internally modified builds. Prebid Server is often integrated into larger ad-tech stacks with custom adapters, custom bidder configuration, or bespoke traffic handling. If your environment includes such customizations, you should not assume the risk is eliminated simply because upstream has issued a fix; you should verify whether similar URL construction logic exists in internal code paths as well.

The source material does not distinguish between Prebid Server Go versus any other packaging or distribution artifact beyond the project-level release. Because the NVD wording refers broadly to Prebid Server versions before 4.4.0, the safest operational assumption is that any deployment running that software line below 4.4.0 requires immediate review and likely upgrade.

CVSS Score Breakdown

The NVD assigns this CVE a CVSS score of 10.0, which places it in the critical range. A score at this level indicates a vulnerability with severe potential impact and likely broad exploitability assumptions. Even without the full vector string in the provided material, the score alone signals that this is not a niche hardening issue but a defect that warrants urgent patching.

From the description, the score is understandable. The attack is network-reachable in the sense that it can be triggered through crafted request input reaching the application. The vulnerability class, SSRF, can expose sensitive internal services or server endpoints that are otherwise inaccessible from the public internet. In high-trust environments, that can have knock-on effects well beyond a single malformed request.

What is not explicitly provided in the available source material is the exact CVSS vector string and each published metric component. Because of that, defenders should avoid over-claiming details such as user interaction requirements or exact privileges required. In the absence of full scoring metadata, the prudent interpretation is simple: treat this as remotely exploitable through application input handling and prioritize it based on the confirmed critical score and available patch.

Exploitation Status

At the time of the research note, there is no confirmed evidence of active exploitation in the wild. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no CISA-confirmed exploitation record to cite at this time.

There is also no confirmed public proof of concept (PoC) in the provided source set. The research note explicitly says no reliable primary-source exploit repository or exploit advisory was identified during that review. That does not reduce the urgency significantly. SSRF vulnerabilities are often straightforward to validate once researchers inspect the patch or compare pre-fix and post-fix code paths, and the fix references are public.

Security teams should therefore use the following defensive wording internally: exploitation in the wild is not confirmed, a public PoC is not confirmed, but exploitation should be considered plausible given the vulnerability class, the critical score, and the availability of patch-related artifacts such as the commit, pull request, and release.

ResponderRunbook · act now

How to Detect It

Detection should focus on two questions: did Prebid Server make unusual outbound requests, and did inbound auction traffic contain suspicious host or subdomain values that could have influenced those requests? Because the root cause involves user-supplied URL components, you are looking for mismatches between expected bidder destinations and actual egress.

Review HTTP egress logs, DNS logs, proxy records, VPC flow logs, and container-level network telemetry for connections from Prebid Server hosts to destinations that are not part of your approved bidder list. Pay particular attention to access to RFC1918 space, link-local addresses, localhost, internal service discovery domains, and cloud metadata endpoints. If your deployment does not normally permit arbitrary outbound requests, any such destination should be treated as suspicious.

Technical Notes

Example suspicious destinations and patterns to hunt for:

169.254.169.254
127.0.0.1
localhost
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
*.internal
*.cluster.local

Example Splunk query for proxy, DNS, or firewall logs where src_app or host tags identify Prebid Server systems:

(index=proxy OR index=dns OR index=firewall)
(src_host="prebid-server*" OR app="prebid-server")
| search dest_ip IN ("169.254.169.254","127.0.0.1")
    OR dest_domain="localhost"
    OR cidrmatch("10.0.0.0/8", dest_ip)
    OR cidrmatch("172.16.0.0/12", dest_ip)
    OR cidrmatch("192.168.0.0/16", dest_ip)
    OR like(dest_domain, "%.cluster.local")
    OR like(dest_domain, "%.internal")
| stats count min(_time) as firstSeen max(_time) as lastSeen by src_host, dest_ip, dest_domain, url

Example grep approach if application or reverse proxy logs retain request parameters that may include suspicious host or subdomain values:

grep -RIE '169\.254\.169\.254|localhost|127\.0\.0\.1|\.internal|\.cluster\.local' /var/log/prebid/ /var/log/nginx/ /var/log/httpd/

If you capture outbound HTTP Host headers or full URLs in egress telemetry, compare them against an allowlist of approved bidder endpoints. Any destination outside that set deserves review, especially if it appeared immediately before an error, timeout, or spike in unusual bid request traffic.

Mitigation and Patching

The primary remediation is to upgrade to Prebid Server 4.4.0. The NVD description explicitly states that the issue is fixed in version 4.4.0, and the associated references include the release page, a security advisory, a fixing commit, and pull request #4802 tied to commit 494ac271cd4b5024df9123ef25ca3cff96390be3.

If you cannot patch immediately, apply compensating controls focused on outbound network restriction. SSRF impact depends heavily on what the vulnerable service can reach. Restrict Prebid Server egress to only the bidder destinations and supporting services it legitimately needs. Block access to cloud metadata endpoints, loopback, link-local, and private address ranges where operationally possible. Also review and disable any custom bidder behavior that accepts externally supplied hostnames or subdomains until the service is upgraded.

Technical Notes

If you deploy Prebid Server from source or Git tags, move to the fixed release:

git fetch --tags
git checkout v4.4.0

If your deployment process builds from the upstream repository, ensure your build references the fixed release or a commit that includes:

494ac271cd4b5024df9123ef25ca3cff96390be3

Example container image workflow, assuming your organization publishes or consumes tagged images aligned to upstream releases:

docker pull <your-registry>/prebid-server:4.4.0
docker stop prebid-server
docker rm prebid-server
docker run -d --name prebid-server <your-registry>/prebid-server:4.4.0

Example temporary egress restriction with Linux iptables to block common SSRF targets while you schedule the patch. Test carefully before production rollout:

iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT

For Kubernetes or cloud-native deployments, implement equivalent NetworkPolicy, security group, or firewall rules so the Prebid Server workload can only reach approved external bidder hosts. After patching, validate that normal auction flows still function and review egress telemetry for any residual attempts to contact disallowed destinations.

References

The primary authoritative reference is the NVD record for CVE-2026-54735, which describes the issue, affected version range, and fixed version. That record is the basis for the vulnerability characterization in this article and should be your first stop for ongoing record changes or scoring updates.

The vendor and project references are also important because they tie the CVE to the actual remediation artifacts. In particular, defenders should review the Prebid Server release and advisory material to align patching, change management, and any internal code review of custom adapters.

If additional vendor guidance or exploitation evidence emerges after publication, defenders should update internal advisories accordingly. For now, the most defensible position is straightforward: Prebid Server versions prior to 4.4.0 are affected, 4.4.0 is the fixed version, active exploitation is not confirmed, and the right move is to patch and lock down egress immediately.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-29

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.