Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-06 | 4 | Disclosure2General2 |
| 2026-03-11 | 1 | Disclosure1 |
Some thoughts on CVE pollution, CVE-2026-28677, SSRF on OpenSift ( project has 1 star on GitHub ), but there is a CVE on it created from the author itself(?) What is the purpose of this beyond a polluted CVE database?
Post summary
The tweet references CVE-2026-28677 as an SSRF on OpenSift, raising concerns about CVE pollution, but provides no PoC, exploit code, or mitigation details.
CVE-2026-28677 (CVSS:8.2, HIGH) is Undergoing Analysis. OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version..https://nvd.nist.gov/vuln/detail/CVE-2026-28677 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE‑2026‑28677 as a high‑severity vulnerability under analysis, providing its CVSS score and a link to the NVD entry.
CVE-2026-28677 OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted… https://www.cve.org/CVERecord?id=CVE-2026-28677
Post summary
The text simply announces the existence of CVE-2026-28677 for OpenSift without providing additional technical or operational details.
CVE-2026-28677 Server-Side Request Forgery in OpenSift URL Ingest Pipeline Before 1.6.3-alpha https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28677
Post summary
The post announces CVE‑2026‑28677 as a Server‑Side Request Forgery vulnerability affecting OpenSift’s URL Ingest Pipeline before version 1.6.3‑alpha, without detailing PoC, exploitation, or patch information.
🟠 CVE-2026-28677 - High OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote U... https://www.thehackerwire.com/vulnerability/CVE-2026-28677/ https://t.co/t4CFS07w7r
Post summary
The tweet announces CVE‑2026‑28677 as a high‑severity issue in OpenSift’s URL ingest pipeline and links to an external article, but provides no technical specifics, PoC, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | opensift | opensift | - | python | - |