CVE-2026-54735
Prebid Server, an open‑source platform for real‑time ad auctions, had a critical flaw that let attackers trick the server into making requests to arbitrary internal URLs. The vulnerability was fixed in version 4.4.0. Users should update to that version or later.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Prebid Server versions earlier than 4.4.0, especially those using bidder adapters that interpolate user‑supplied parameters into request URLs. Typical users are ad‑tech companies running the open‑source platform in the cloud.
Real-world impact
An attacker could send a crafted bid request that causes the server to reach internal services or sensitive endpoints, potentially exposing data or allowing further attacks inside the network.
Why this severity
The CVSS score of 10 reflects that the flaw is exploitable over the network, requires no user interaction, and gives an attacker full control over the server’s outbound requests, leading to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Prebid Server to version 4.4.0 or later.
NVD-referenced vendor advisory
Timeline
- Jul 29, 2026 · 20h agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 19h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.