CVE-2025-68662 is a high severity flaw (CVSS 7.6) in Discourse. A hostname validation issue in FinalDestination could bypass the server side request forgery protections under certain conditions. Update to 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0, depending on your channel. The advisory says no workarounds are known.
What's affected
- Discourse before 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0.
- Fixed in 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0, depending on your release channel.
- No known workarounds, per the advisory.
How to check if you're exposed
Open the admin dashboard in Discourse. The version and the update status are shown on the main admin page. For a standard install, the admin updater page lists pending updates.
Match your version against the four fixed releases for your channel: stable 3.5.x, or the dated 2025 and 2026 releases.
What to do now
- Open the admin updater and apply the latest release for your channel.
- For a container install, rebuild with the launcher so the new version is deployed.
- Because there are no workarounds, do not wait on configuration changes. Update.
- Check outbound network rules from the Discourse host, so it cannot reach internal services it does not need.
- Review recent link preview and onebox activity if you suspect misuse.
If your Discourse host runs on a cloud provider, block its access to the metadata address at the network level. That limits what any SSRF flaw can reach, in this software or in any other that fetches remote content. It does not replace the update, but it shrinks the damage if a check fails.
Why it matters
The weakness is CWE-918, server side request forgery. Discourse fetches remote pages for link previews and image downloads, and it protects itself by checking that a host name does not resolve to an internal address. The flaw is in how a host name was validated, so the check could be sidestepped.
SSRF matters because the server can often reach places that outsiders cannot, such as cloud metadata services and internal admin pages. The record does not list this CVE as exploited in the wild.
Quick check
Is there a workaround for CVE-2025-68662?
The advisory says no known workarounds exist. Updating to a fixed release is the remedy.
Sources
Last reviewed: 19 October 2026.
