CVE-2026-42858 is a high severity server side request forgery flaw (CVSS 8.5) in Open edX Platform. The SAML provider data sync endpoint passes an admin supplied metadata URL straight to an HTTP client. The advisory lists Ulmo and later as patched, and two commits carry the fix.
What's affected
The advisory describes the affected code as everything containing SAMLProviderDataViewSet.sync_provider_data, and the patched versions as Ulmo and later. The NVD record points to two fixing commits: 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054.
The attacker must be an authenticated Enterprise Admin, so this is a risk from privileged or compromised admin accounts rather than anonymous visitors.
How to check if you're exposed
- Find out which Open edX release you run. Your Tutor or deployment configuration usually names it.
- If you run a release before Ulmo, check whether your fork includes the two commits above.
- List your Enterprise Admin accounts and check that each one is needed and protected with a strong sign in.
- Review outbound network rules for the application servers. Cloud metadata addresses such as the link local one used by AWS are the usual target.
What to do now
- Move to the Ulmo release or later, or backport the two commits to your fork.
- Review and reduce the number of Enterprise Admin accounts.
- Block application servers from reaching cloud instance metadata endpoints, or require the token based metadata service where your cloud supports it.
- Restrict outbound traffic from the platform to the destinations it needs.
- Check logs for calls to the sync provider data endpoint with unusual URLs.
Why it matters
The weakness is CWE-918, server side request forgery. The endpoint takes a URL in the metadata_url parameter and calls requests.get on it with no check of scheme, address or destination. The server then makes the request from inside your network and can return content that the admin would not otherwise see.
The advisory names internal services and cloud metadata endpoints as targets. Reaching a metadata endpoint can expose credentials, which is why the confidentiality impact is high. The required admin role keeps the exposure narrower. The KEV flag is false.
Quick check
Do I need to worry if my admins are all trusted?
A compromised admin account is enough to use it, so patching and tight outbound rules still matter.
Sources
- GitHub security advisory GHSA-328g-7h4g-r2m9 (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
