Server-Side Request Forgery Vulnerability in OCS Inventory Server by Open Computer and Software Inventory Next Generation

CVE-2026-76177

What is CVE-2026-76177?

A server-side request forgery (SSRF) vulnerability exists within the /ocsreports/?function=tele_activate endpoint of OCS Inventory NG. Due to inadequate validation of the HTTPS_SERV and FILE_SERV parameters, an authenticated user with operator privileges can manipulate these parameters to direct the OCS Inventory server to make unauthorized HTTP/HTTPS requests. This exploitation may lead to access of internal network services or sensitive metadata from cloud resources, creating significant security risks for organizations utilizing the affected software.

References