Arbitrary Outbound Connection Vulnerability in Discourse Discussion Platform

CVE-2026-33185

What is CVE-2026-33185?

Discourse, a widely-used open-source discussion platform, contains a vulnerability affecting specific versions that permits the group email settings test endpoint to establish outbound connections to arbitrary hosts and ports. This vulnerability could enable unauthorized probing of internal network infrastructure, leading to potential security risks. Notably, the affected endpoint was accessible to non-staff group owners, thereby amplifying the threat. The issue has been effectively addressed in the patched versions 2026.1.3, 2026.2.2, and 2026.3.0.

References