Description
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-10-13
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation via Server‑Side Request Forgery
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery that can be abused to send arbitrary requests from the host. Exploitation does not require user interaction and changes the privilege scope, allowing an attacker to access internal resources or elevate privileges. The weakness is classified as CWE‑918.

Affected Systems

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. Exact vulnerable versions are not listed in the CVE; administrators should verify the build numbers against the Adobe advisories and update wherever possible.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is inferred to be remote, originating from the application’s ability to construct and perform outbound HTTP requests without proper validation. Any reach to internal services or privileged resources can lead to broader compromise.

Generated by OpenCVE AI on October 16, 2026 at 02:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Adobe‑released patch for the Content Credentials components as soon as it becomes available.
  • Restrict or block outbound traffic from the application to internal networks and sensitive endpoints using firewall or proxy rules.
  • Validate and whitelist any external URLs that the application accepts, ensuring no internal resources can be accessed via the vulnerable request mechanism.

Generated by OpenCVE AI on October 16, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe c2pa
Adobe c2pa-web
Adobe c2patool
CPEs cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*
cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*
cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe c2pa
Adobe c2pa-web
Adobe c2patool

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Title CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Adobe C2pa C2pa-web C2patool
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T14:42:59.703Z

Reserved: 2026-09-22T11:06:57.165Z

Link: CVE-2026-95634

cve-icon Vulnrichment

Updated: 2026-10-14T14:41:42.559Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T22:19:30.853

Modified: 2026-10-15T18:42:11.487

Link: CVE-2026-95634

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T02:30:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)