SolarWinds Observability Self-Hosted contains a Server‑Side Request Forgery flaw that lets an authenticated user direct the application server to query arbitrary URLs. This could allow the attacker to reach internal services or transfer data to an external destination without the user’s knowledge. The weakness is a classic example of insecure handling of external request URIs.

The vulnerability affects SolarWinds Observability Self‑Hosted. Users running any supported version before the 2026.4 release are potentially vulnerable; newer releases contain the fix.

The CVSS score of 6.4 indicates moderate severity. Because the flaw requires an authenticated session, casual exploitation is limited, and the EPSS score is currently unavailable, making widespread attacks less likely. The issue is not listed in the CISA KEV catalog, and no publicly disclosed exploits have been reported. Nonetheless, an attacker with legitimate credentials could leverage the SSRF to exfiltrate data or pivot to internal systems if outbound network rules are permissive.