Secuno
ENNL
Book demo

CVE-2026-54734

10.0 CRITICAL
  1. Published17 Sept 2026

Description

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-925768.6
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the…
CVE-2025-565639.8
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite…
CVE-2026-685369.8
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older…
CVE-2026-925668.2
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the…
CVE-2026-615599.6
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in…
CVE-2026-545498.3
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta…

Frequently asked

Is CVE-2026-54734 being actively exploited?

CVE-2026-54734 is not in the CISA KEV catalog.

How severe is CVE-2026-54734?

CVE-2026-54734 has a CVSS 3.1 base score of 10.0, rated critical.

How do I fix CVE-2026-54734?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-54734 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.