Remote Code Execution Vulnerability in Open edX Platform Affecting Enterprise Admin Users

CVE-2026-42858

What is CVE-2026-42858?

The Open edX Platform features a serious issue within its sync_provider_data endpoint, which allows authenticated Enterprise Admin users to supply arbitrary URLs through the metadata_url POST parameter. This URL is processed by the fetch_metadata_xml() function without proper validation, leaving the system vulnerable to attacks. Malicious users with Enterprise Admin privileges can exploit this flaw to redirect server requests to internal services or attacker-controlled locations, potentially compromising sensitive data and system integrity. The vulnerability was addressed in the latest commits, ensuring enhanced security protocols.

References