CVE-2026-42860

high

Published 2026-05-05 · Modified 2026-05-20

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

8.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.5

Description

The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.

Predictions

Exploit likelihood

90%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	edx-enterprise	`>=7.0.2,<7.0.5`	`7.0.5`
PIP	edx-enterprise	`>= 7.0.2, <= 7.0.4`	`7.0.5`

Application impact

Vendor	Product	Versions	Fixed
openedx	edx-enterprise	`{"startIncluding":"7.0.2","endExcluding":"7.0.5"}`	`7.0.5`

References

CWEs

CWE-918

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.