CVE-2026-42858

NVD data not available for this CVE. It may be pending analysis or not yet published.

Related Intelligence (1)

CRITICALVulnerability

NVD CRITICAL: CVE-2026-42858 — Open edX Platform enables the authoring and delivery of online learning at any s...

Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker

CVE-2026-42858
NIST NVD