Server-Side Request Forgery in openstatusHQ Openstatus by openstatus

CVE-2026-90486

What is CVE-2026-90486?

A vulnerability exists in the openstatusHQ Openstatus product, specifically within the functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. This flaw facilitates server-side request forgery attacks, allowing malicious actors to manipulate requests and potentially access sensitive internal resources. The flaw can be exploited remotely, and continuous updates make it difficult to pinpoint specific affected versions. A patch has been made available to address this issue, and users are strongly advised to implement it promptly.

References