Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-30T07:23:04 PIA: python: requests: urllib3: PIA: Unauthenticated Server-Side Request Forgery via OIDC issuer allowlist bypass 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CWE-918

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.

A flaw was found in PIA. An unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability by crafting a malicious OpenID Connect (OIDC) issuer URL. This bypasses an internal allowlist due to inconsistent URL parsing between Python's `urlparse` and the `requests`/`urllib3` libraries. Successful exploitation allows the attacker to force the application to connect to arbitrary external hosts, potentially leading to information disclosure or further attacks.

Red Hat Hardened Images Not affected cosign Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected grafana13.1 Red Hat Hardened Images Not affected jaeger Red Hat Hardened Images Not affected llvm Red Hat Hardened Images Not affected llvm21 Red Hat Hardened Images Not affected mariadb11.8 Red Hat Hardened Images Not affected python3.10 Red Hat Hardened Images Not affected python3.11 Red Hat Hardened Images Not affected python3.12 Red Hat Hardened Images Not affected python3.13 Red Hat Hardened Images Not affected python3.14 Red Hat Hardened Images Not affected python-attrs Red Hat Hardened Images Not affected python-cryptography Red Hat Hardened Images Not affected python-gitlab Red Hat Hardened Images Not affected python-requests Red Hat Hardened Images Not affected python-rpds-py Red Hat Hardened Images Not affected python-sentry-sdk Red Hat Hardened Images Not affected python-trustme Red Hat Hardened Images Not affected python-urllib3 Red Hat Hardened Images Not affected rust Red Hat Hardened Images Not affected spire1.14 Red Hat Hardened Images Not affected spire1.15 Red Hat Hardened Images Not affected swift-lang Red Hat Hardened Images Not affected trivy https://www.cve.org/CVERecord?id=CVE-2026-18353 https://nvd.nist.gov/vuln/detail/CVE-2026-18353 https://github.com/eclipse-csi/pia/security/advisories/GHSA-v249-9xjm-qhgf