CVE-2026-90486Medium· 6.3▾ Sunlit

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 12, 2026

Updated

Sep 15, 2026

CVSS

6.3

Vendor

openstatusHQ

Product

openstatus

CWE

CWE-918

Depth score

35 · Low

EPSS

0.40% · p34

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

decided 2026-09-15

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 15.

0.2% → 0.4%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 13 days

Sep 12, 2026Published
Disclosed via NVD
Sep 15, 2026Record revised
Last analysed / modified upstream
Sep 15, 2026EPSS first tracked
0.2%
Sep 25, 2026EPSS peak
0.2% → 0.4%

openstatusHQ CWE-918 #nvd #cve.org

Affected

openstatus f04c827112f30a11d571ebdad3892826034d6265

Full technical detail▾

Overview

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 86f370c9c20074c3c3fdec53a359874b8e670fd4. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed