CVE-2026-54734

Executive Summary

CVE-2026-54734 is a server-side request forgery (SSRF) vulnerability in Prebid Server Java, the Java implementation of the open-source Prebid Server header bidding platform. Prior to version 3.43.0, certain bidder adapters interpolate user-supplied bid-request parameters directly into outbound request URLs without validating the resulting domain or path segment using the project's HttpUtil utility. An unauthenticated attacker who can supply bid-request parameters (typically via an OpenRTB bid request routed to a vulnerable adapter) can force the server to issue HTTP requests to attacker-chosen destinations — including internal network services, cloud metadata endpoints, and other sensitive endpoints reachable with the server's network privileges.

The vulnerability is rated CVSS 3.1 base score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a remotely exploitable, unauthenticated flaw with scope change and full confidentiality, integrity, and availability impact. No public PoC, Nuclei template, or exploit code is currently available, and the CVE is not listed in CISA KEV. The vendor has fixed the issue in Prebid Server Java 3.43.0, though the automated patch-confidence tracker for this report shows 0/4 sources with confirmed patch evidence — meaning patch verification should be performed directly against the upstream release before relying on any single source. EPSS has not yet been scored by FIRST.org.

Technical Analysis

Prebid Server Java acts as an intermediary in programmatic advertising: it receives OpenRTB bid requests from publishers or exchanges, fans them out to numerous downstream "bidder adapters," and aggregates the responses. Each adapter constructs an outbound HTTP request to its respective bidder endpoint, embedding values such as placement IDs, site/app metadata, sizes, and assorted custom parameters supplied by the incoming bid request.

The core flaw described by NVD is a classic CWE-918 Server-Side Request Forgery arising from insufficient validation of user-controlled URL components. According to the description, "certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment." This means:

• HttpUtil is the project's intended validation/allow-listing utility for ensuring the host/domain and path segments of constructed URLs stay within expected boundaries. Adapters that skip this step do not enforce that constraint.
• Because the interpolation is direct (i.e., the attacker's string is concatenated into the URL rather than being escaped, encoded, or passed as a separate query component), an attacker can influence the effective destination of the outbound request. Depending on how the adapter is written, this can redirect the host portion, append an unintended path segment, or otherwise pivot the request target.
• The flaw is present "prior to 3.43.0," and the vendor states the issue "is fixed in version 3.43.0."

The attack surface is the bid-request ingestion path. Prebid Server Java is a public-facing service by design (exchanges and publishers POST OpenRTB JSON to it), so the interface that carries the malicious parameter is network-reachable and, per the CVSS vector, requires no authentication (PR:N) and no user interaction (UI:N). The "Network" attack vector (AV:N) and "Low" attack complexity (AC:L) indicate the exploit does not need special conditions or a race window. The "Changed" scope (S:C) and triple-High impact (C:H/I:H/A:H) reflect that a successful SSRF in this context can reach resources beyond the vulnerable component itself and can materially affect their confidentiality, integrity, and availability (e.g., reading cloud credentials, invoking internal admin APIs, or disrupting internal services).

No public proof-of-concept has been released, and the NVD description does not name the specific vulnerable adapters. Consequently, this report deliberately does not enumerate adapter names, function signatures, or parameter names beyond what the description provides. The exploit class is well understood (SSRF), but the precise set of interpolated parameters and which adapters are affected are not stated in the source data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-918) and the NVD description, and uses only the terms and components that appear in the source material.

1) Reconnaissance / target identification. An attacker identifies a reachable Prebid Server Java deployment prior to 3.43.0. These servers are typically exposed as public HTTP endpoints that accept OpenRTB bid requests, so discovery is a matter of finding the endpoint (via Shodan using the dorks in Metadata, or by interacting with known exchanges/publishers that proxy through Prebid Server). The attacker notes the server version if disclosed, since only versions < 3.43.0 are affected.

2) Triggering the flaw class. The attacker crafts an OpenRTB bid request containing user-supplied parameters that a vulnerable bidder adapter will interpolate into its outbound URL. Because the adapter does not invoke HttpUtil to validate the domain or path segment, the attacker-supplied value is not constrained to the adapter's legitimate bidder host. The attacker submits this request to the Prebid Server ingestion endpoint; the server then processes the bid and, for the vulnerable adapter, constructs an outbound request whose destination is attacker-influenced.

3) Execution method. This is a request-forwarding attack: there is no injected code and no payload executed on the target host. The "payload" is the malicious URL component carried inside the bid request, and the exploitation primitive is the server issuing an HTTP request to the destination the attacker steered it toward. At the vulnerability-class level, SSRF allows the attacker to reach internal-only destinations using the server's network position and its credentials/network access. Common high-value SSRF targets include cloud instance metadata services (often reachable at link-local addresses), internal administrative APIs, service meshes, and other hosts that are not exposed to the public internet. The NVD description explicitly names these categories: "internal network services, metadata endpoints, or other sensitive server endpoints."

4) Post-exploitation impact. Because the outbound request originates from the Prebid Server host, success can yield: (a) exfiltration of sensitive data returned by internal services (confidentiality), (b) state changes on internal endpoints that accept unauthenticated or header/credential-trusting requests (integrity), and (c) denial of service against internal resources via repeated or resource-intensive requests (availability). On cloud infrastructure, reaching a metadata endpoint could enable credential theft that escalates well beyond the Prebid Server itself — which is consistent with the CVSS "Changed" scope and triple-High impact ratings. Blind SSRF (where the attacker cannot directly read the response) may still be leveraged via timing, error-based oracles, or side effects on internal state.

Impact Assessment

The CVSS 3.1 base score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H describes the worst case: a remote, unauthenticated, low-complexity attack with no user interaction that crosses a security boundary (S:C) and can fully compromise confidentiality, integrity, and availability of the resources the server can reach.

Business impact centers on anything reachable from the Prebid Server host's network position:

• Cloud credential and secret exposure. If the server runs in a cloud environment and can reach an instance metadata service, SSRF can expose IAM credentials, which in turn can grant access to storage buckets, compute, and other cloud services. This is the highest-impact scenario and the primary reason for the elevated severity.
• Internal service reach. The server commonly sits in a DMZ or application tier with network paths to internal APIs, caches, databases, and orchestration endpoints. SSRF can turn the Prebid Server into an unwitting proxy into that network.
• Data confidentiality and integrity. Ad-tech platforms carry sensitive audience, pricing, and identity data; internal endpoints reachable via SSRF could leak or be manipulated, with downstream privacy and regulatory consequences.
• Availability. SSRF can be used to flood internal resources or trigger expensive operations, degrading the bidding pipeline itself.

Blast radius depends on the deployment's network segmentation. A Prebid Server with broad egress and no egress filtering can pivot widely; a tightly segmented deployment limits the reachable set. Because the vulnerability is unauthenticated (PR:N), any internet client that can submit a bid request is a potential attacker, and no credentials are required. The lack of a public exploit reduces immediate opportunistic risk, but the flaw is trivially describable and could be weaponized without much effort — organizations running affected versions should treat this as high priority.

Detection Guidance

Sigma Rule

title: Potential SSRF via Prebid Server Java Bid Request Parameter Interpolation
id: 7d4a9c2e-3b1f-4e6a-9c2d-8f5b1a2c9e01
status: experimental
description: Detects Prebid Server Java outbound requests whose destination is influenced by user-supplied bid-request parameters, consistent with CVE-2026-54734 SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54734
author: valtersit.com
date: 2026/01/01
logsource:
  category: proxy
detection:
  selection_process:
    ProcessImage|endswith:
      - 'prebid-server'
      - 'prebid-server.jar'
  selection_suspicious_dst:
    DestinationHostname|re:
      - '^(127\.0\.0\.1|localhost|169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com)$'
      - '^10\..*'
      - '^192\.168\..*'
      - '^172\.(1[6-9]|2[0-9]|3[0-1])\..*'
  condition: selection_process and selection_suspicious_dst
falsepositives:
  - Legitimate adapters configured to target internal test endpoints in staging
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_54734_Prebid_SSRF_Indicators
{
    meta:
        description = "Detects potential SSRF indicator strings in Prebid Server Java configuration/logs related to CVE-2026-54734"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54734"
        severity = "high"
    strings:
        $meta1 = "169.254.169.254" ascii
        $meta2 = "metadata.google.internal" ascii
        $meta3 = "metadata.azure.com" ascii
        $prebid = "prebid-server" ascii nocase
        $httpUtil = "HttpUtil" ascii
        $ver = "3.43.0" ascii
    condition:
        uint32(0) == 0x504B0304 and
        (any of ($meta*)) and
        ($prebid or $httpUtil)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54734 Prebid Server Java SSRF via Bid Request - Suspicious Outbound Target"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com|127\.0\.0\.1)/i"; http.header; content:"Host"; reference:cve,2026-54734; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54734; classtype:attempted-recon; sid:202654734; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

network where process.name : "prebid-server*" and
  destination.ip in ("127.0.0.1","169.254.169.254") and
  event.action == "connection_attempted"

Splunk SPL Query

index=proxy OR index=network sourcetype=*proxy* OR sourcetype=*stream_http*
| eval dst=coalesce(dest_host, url_domain, host)
| where match(dst, "(?i)^(127\.0\.0\.1|localhost|169\.254\.169\.254|metadata\.google\.internal|metadata\.azure\.com)$") OR match(dst, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)")
| search (process_name="*prebid-server*" OR user_agent="*prebid*" OR url=*openrtb* OR url=*bidrequest*)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dst, url, process_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,ssrf,prebid,">
  <rule id="202654" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">prebid-server</field>
    <regex field="destination.ip">^(127\.0\.0\.1|169\.254\.169\.254)$|^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.</regex>
    <description>CVE-2026-54734: Possible SSRF - Prebid Server requested internal or metadata endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_54734,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, or affected-version list was supplied with this intelligence package; the only authoritative statement available is that the issue "is fixed in version 3.43.0." Because automated patch evidence is absent, confirm the fix directly against the upstream Prebid Server Java release/commit history before closing any tracking ticket.

1. Immediate mitigations (before upgrade):

   • Apply network egress filtering on Prebid Server hosts: deny outbound traffic to link-local (169.254.0.0/16, including metadata services), loopback, and RFC1918 ranges except where explicitly required for known bidder endpoints.
   • Enforce a strict egress allow-list of legitimate bidder hostnames/IPs so that even if an adapter misconstructs a URL, the request cannot reach unauthorized destinations.
   • On cloud hosts, disable or restrict access to instance metadata endpoints (e.g., enforce IMDSv2 or equivalent) to reduce the value of a successful SSRF.
   • If vulnerable adapters can be identified, disable or remove those adapters from configuration until upgraded; gate them behind authentication if the platform supports it.
   • Rate-limit and monitor bid-request endpoints for anomalous outbound request patterns.

2. Patch / upgrade steps:

   • Upgrade Prebid Server Java to 3.43.0 or later, where the flaw is fixed per the NVD description.
   • Verify the artifact hash/signature of the release and confirm the version string at runtime.
   • Review adapter configurations post-upgrade to ensure HttpUtil-based validation is in effect for all outbound URL construction.
   • Re-test egress rules after upgrade; do not remove controls until validation is confirmed.

3. Long-term hardening:

   • Centralize all outbound URL construction behind HttpUtil (or an equivalent validated builder) and add CI checks/linting to prevent adapters from bypassing it.
   • Adopt a defense-in-depth SSRF posture: DNS pinning, redirect blocking, response size limits, and strict egress policy at the platform layer.
   • Maintain SBOM-driven dependency tracking so future Prebid Server Java releases are flagged and rolled out promptly.
   • Instrument outbound-request telemetry (destination host, adapter, originating parameter) to detect future interpolation regressions.

References

• NVD — CVE-2026-54734: https://nvd.nist.gov/vuln/detail/CVE-2026-54734
• Prebid Server Java project (upstream source & release notes for 3.43.0): https://github.com/prebid/prebid-server-java
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-918 Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• FIRST EPSS (currently unscored for this CVE): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild: None identified. No public PoC, exploit code, or Nuclei template is available; CVE-2026-54734 is not listed in CISA KEV, and no threat actor activity has been attributed to this CVE in the supplied data.