CVE-2026-108572

Executive Summary

CVE-2026-108572 is a Server-Side Request Forgery (SSRF) vulnerability in Casdoor, an open-source identity and access management (IAM) platform based on the Casbin framework. The flaw resides in the CasP3ProxyValidate function within controllers/cas.go, where manipulation of the pgtUrl argument allows an authenticated attacker to induce the Casdoor server to issue arbitrary outbound HTTP requests. This affects Casdoor versions up to and including 3.164.0 and 4.10.0, with a fix available in version 4.11.0; the exploit has been publicly disclosed, increasing the risk of opportunistic exploitation.

Technical Analysis

The vulnerability class is Server-Side Request Forgery (CWE-918), arising from insufficient validation of a user-controllable URL parameter processed by the CasP3ProxyValidate function in controllers/cas.go. In CAS (Central Authentication Service) protocol implementations, the Proxy Granting Ticket (PGT) flow involves callback URLs used to deliver proxy-granting tickets. The pgtUrl argument represents such a callback URL. Because the application accepts and acts upon this attacker-influenced value without adequately restricting it to trusted internal or external destinations, the Casdoor backend can be coerced into performing HTTP requests to arbitrary hosts and schemes chosen by the attacker.

The specific validation logic that fails is not described in the available NVD data beyond the fact that "manipulation of the argument pgtUrl leads to server-side request forgery." As a result, the precise bypass technique (for example, whether the fix enforces a hostname allowlist, blocks private IP ranges, restricts URL schemes, or prevents redirect chasing) cannot be stated with certainty from the provided information. What is architecturally relevant is that event/user-server nodes in Casdoor commonly run with reachable network position to internal services, cloud metadata endpoints, and other backend components — making SSRF a meaningful primitive even at low privilege.

Key technical facts derivable from the supplied data:

• Affected component: Proxy Validation.
• Affected function: CasP3ProxyValidate.
• Affected file: controllers/cas.go.
• Attacker-controlled input: the pgtUrl argument.
• Effect: server-side request forgery.
• Attack vector: network-accessible and remotely performable.
• Privileges required: Low (per CVSS — an authenticated user context is implied).
• Confidentiality impact: Low; Integrity and Availability impacts: None.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (score 4.3) indicates that although the vulnerability is remotely reachable with no user interaction, it requires low privileges and yields limited confidentiality impact. This is consistent with an SSRF that can be used for information disclosure (for example, reaching internal-only endpoints or non-public services) rather than for direct code execution or data modification.

Exploitation Scenarios

No public proof-of-concept code was supplied in the vulnerability data; the exploit has nonetheless been described as publicly disclosed, and the attack chain below is inferred from the SSRF vulnerability class and the CAS proxy-validation context. No specific function names, endpoints, or parameters beyond those in the source description are asserted.

1. Reconnaissance and target identification An attacker identifies an exposed Casdoor deployment (self-hosted IAM installations, often internet-facing for SSO purposes). Because the vulnerable function is part of the CAS proxy validation flow, the attacker must be able to reach the relevant CAS-related handling of proxy requests and must satisfy the low-privilege requirement indicated by the CVSS vector (PR:L). This generally means possessing valid, low-privileged credentials within the Casdoor tenant.

2. Triggering the flaw (SSRF) The attacker submits a request that exercises the CasP3ProxyValidate code path and supplies a crafted value for the pgtUrl argument. By setting pgtUrl to a URL of the attacker's choosing — such as an internal address, a loopback interface, an RFC1918 host, or a cloud instance metadata address — the attacker attempts to make the Casdoor server issue a request on their behalf. The essential mechanism is that the application fails to constrain where that callback request is sent.

3. Payload/execution at the vulnerability-class level Because this is SSRF, "exploitation" does not mean code injection into the target; instead, the target server acts as a request proxy. The attacker's crafted pgtUrl value causes the Casdoor backend to send an HTTP(S) request to an endpoint it can reach but the attacker normally cannot. The attacker then observes the outcome (response content, timing differences, error codes, or redirect behavior) to extract information or affect internal reachability.

4. Post-exploitation impact Consistent with the CVSS scoring (C:L; I:N; A:N), the realistic post-exploitation outcome is limited information disclosure and internal service reconnaissance. Potential consequences include reading responses from internal-only HTTP services, probing internal network topology, and interacting with cloud metadata services where that service is exposed — though the low confidentiality subscore limits the presumed severity. The attacker may chain this SSRF with other weaknesses for lateral movement, but no such chaining is established by the provided data.

Impact Assessment

• Confidentiality: Low. The SSRF can disclose information from services reachable by the Casdoor server, but the CVSS C:L subscore indicates constrained data exposure.
• Integrity: None. The vulnerability as scored does not permit modification of data.
• Availability: None. No denial-of-service impact is indicated.
• Scope: Unchanged (S:U). The impact remains within the security authority of the vulnerable component.
• Attack vector/conditions: Network (AV:N), Low complexity (AC:L), Low privileges (PR:L), No user interaction (UI:N). This combination means an authenticated low-privileged user can trigger the vulnerability without tricking a victim, which raises the practical risk in multi-tenant or externally exposed IAM deployments.

Blast radius: any organization running Casdoor ≤ 3.164.0 or ≤ 4.10.0 as its identity provider, particularly those with the server positioned to reach internal networks or cloud metadata endpoints. Because Casdoor is an authentication hub, compromise or abuse of the node can have outsized implications for trust across integrated applications. However, the moderate CVSS score (4.3) and absence of KEV listing indicate this is not currently assessed as mass-exploited.

Detection Guidance

Sigma Rule

title: Casdoor CAS Proxy Validate SSRF Attempt (CVE-2026-108572)
id: 9f2a1c74-3b6e-4d51-9a0c-casdoor108572
status: experimental
description: Detects requests to the Casdoor CAS proxy validation endpoint containing a pgtUrl parameter that points to internal, loopback, link-local, or metadata addresses, indicating SSRF attempts.
author: SOC Threat Intelligence
date: 2026/01/01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108572
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-path|contains:
      - '/cas/'
  selection_param:
    cs-uri-query|contains: 'pgtUrl='
  selection_ssrf_target:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '0.0.0.0'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
      - '::1'
      - 'metadata.google.internal'
      - 'file://'
  condition: selection_endpoint and selection_param and selection_ssrf_target
falsepositives:
  - Legitimate deployments intentionally configuring internal PGT callback URLs
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_108572_Casdoor_SSRF_Patterns
{
    meta:
        description = "Detects Casdoor SSRF-related indicators referencing the vulnerable proxy validation path and pgtUrl parameter"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108572"
        severity = "medium"
        date = "2026-01-01"

    strings:
        $fn1 = "CasP3ProxyValidate" ascii wide nocase
        $file1 = "controllers/cas.go" ascii wide nocase
        $param1 = "pgtUrl" ascii wide nocase
        $meta1 = "169.254.169.254" ascii wide
        $scheme1 = "file://" ascii wide

    condition:
        ($fn1 or $file1) and $param1 and 1 of ($meta1, $scheme1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108572 Casdoor CAS SSRF via pgtUrl parameter"; flow:to_server,established; http.uri; content:"/cas/"; nocase; http.uri; content:"pgtUrl"; nocase; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|0\.0\.0\.0|\[::1\]|metadata\.google\.internal|10\.[0-9]|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/iU"; reference:cve,2026-108572; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-108572; classtype:web-application-attack; sid:2026108572; rev:1;)

Elastic Detection

sequence by client.ip with maxspan=30s
  [ network where
      url.path : "*pgtUrl*" and
      (url.path : "*169.254.169.254*" or
       url.path : "*127.0.0.1*" or
       url.path : "*localhost*" or
       url.path : "*0.0.0.0*" or
       url.path : "*10.*" or
       url.path : "*192.168.*" or
       url.path : "*172.16*" or
       url.path : "*172.17*" or
       url.path : "*metadata.google.internal*") ]
  [ network where url.path : "*cas*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where match(uri, "pgturl")
| where match(uri, "127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.169\.254|metadata\.google\.internal|10\.[0-9]{1,3}\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.") OR match(uri, "file%3a|file://")
| rex field=uri "pgtUrl=(?<pgt_target>[^&\s]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(pgt_target) as targets by src_ip, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,casdoor,">
  <rule id="1085720" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>pgtUrl</url>
    <regex type="pcre2">(?i)pgtUrl=(https?%3A%2F%2F|https?://)?(127\.0\.0\.1|localhost|0\.0\.0\.0|169\.254\.169\.254|metadata\.google\.internal|10\.\d{1,3}\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)</regex>
    <description>CVE-2026-108572: Possible Casdoor CAS proxy SSRF attempt via pgtUrl parameter</description>
    <mitre>
      <id>T1190</id>
      <id>T1090</id>
    </mitre>
    <group>cve_2026_108572,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references a fixed version (4.11.0) and two patch commits, but no independently tracked patch evidence was available to this data set; the guidance below reflects the vendor advisory information supplied.

1. Immediate mitigations

• Restrict network egress from the Casdoor server so it cannot reach internal-only services, managed metadata endpoints (e.g., link-local 169.254.0.0/16), or loopback interfaces it does not require. Apply least-privilege egress rules and DNS restrictions.
• Block or sanitize the pgtUrl parameter at the edge (reverse proxy/WAF) by rejecting private, loopback, link-local, and metadata addresses, and non-HTTP(S) schemes.
• Limit who can access CAS proxy-validation functionality (the CVSS PR:L indicates authentication is required); disable unused CAS proxy features where possible.
• Monitor for anomalous outbound requests originating from the Casdoor host.

2. Patch/upgrade steps

• Upgrade Casdoor to version 4.11.0, which the vendor states addresses the issue.
• For auditing, the associated patch commits are 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9 and ada08ecd10cbf158f593dee23a8bab63efecf995.
• Validate the upgrade in a staging environment and confirm CAS proxy behavior matches intent before production rollout.

3. Long-term hardening

• Enforce strict server-side allowlisting for all user-supplied callback/redirect URLs across the application, not only in proxy validation.
• Adopt a centralized SSRF-safe HTTP client that resolves and validates destination host/IP after redirect following.
• Segment IAM infrastructure from sensitive internal networks and enforce metadata endpoint protections.
• Track upstream releases for Casdoor and subscribe to advisories for the Casbin/Casdoor ecosystem; revalidate the patch status as vendor evidence becomes available.

References

• NVD — CVE-2026-108572: https://nvd.nist.gov/vuln/detail/CVE-2026-108572
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• Casdoor project repository/advisories: https://github.com/casdoor/casdoor
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: The exploit has been publicly disclosed per the NVD description, but no public PoC or exploit-code artifact was supplied in the provided data set. No threat-actor campaign or confirmed in-the-wild exploitation evidence was provided.