CVE-2026-54735Disclosure(prebid / prebid_server)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch prebid prebid_server systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

prebid CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/prebid/prebid-server/releases/tag/v4.4.0

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

prebid_server

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 5 classified signals
Peaked 2d ago at 3 mentions (2026-07-29); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

prebid

Products

prebid_server

Deep dive

Activity timeline6 mentions / 3d

Signal classification2 categories

Disclosure

583.3%

Patch

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	3	Disclosure3
2026-07-30	2	Disclosure1Patch1
2026-08-11	1	Disclosure1

Full discourse6 posts

Aretiq.AI@AretiqAI91d
Disclosure
ARETIQ Daily Vulnerability Bulletin — July 29, 2026 🔴 CRITICAL: CVE-2026-54735 (prebid/prebid-server) AAS 12.3 🔴 CRITICAL: CVE-2026-58161 (apache_software_foundation/apache_traffic_server) AAS 12.2 — PoC available 🔴 CRITICAL: CVE-2026-63227 (an_unrestricted_scorm_file_upload_vulnerability_in_koollab_lms_allowed_an_authenticated_module_designer_to_upload_a_scorm_package_containing_a_php_webshell_to_a_publicly_accessible_directory_and_execute_arbitrary_code_on_the_server./koollab_lms) AAS 12.1 28 vulnerabilities — CRITICAL: 3, HIGH: 25 Full bulletin: https://aretiq.ai/bulletins/2026-07-29/
Post summary
A vulnerability bulletin announcing 28 critical/high CVEs, with brief technical details and a note that a PoC exists for one vulnerability, but no exploitation or patch information.
00040195
232 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨Critical - Prebid Server SSRF via Bidder Adapter URL Interpolation (CVE-2026-54735) Prebid Server bidder adapters that interpolate user-supplied bid request params into outbound request URLs fail to validate host/subdomain values. An attacker can craft bid request parameters to force server-side requests to unintended destinations, probing internal services or hitting sensitive endpoints. 👉Affected: http://github.com/prebid/prebid-server <= 4.3.x (v2/v3/v4) | Upgrade to 4.4.0
Post summary
The post announces a critical SSRF vulnerability (CVE‑2026‑54735) in Prebid Server (bidder adapters) and recommends upgrading to version 4.4.0. No PoC, exploit, or active exploitation is mentioned.
0001069
275 followersView on X
LibTracker@libtracker_io79d
Disclosure
CVE-2026-54735 (critique, GitHub) : request forgery dans prebid-server (Go), extraction possible de données de l'environnement hôte. Exposés ? #CVE
Post summary
The post notes CVE-2026-54735 as a request forgery vulnerability in prebid-server that could enable extraction of host environment data.
0000040
2 followersView on X
SecAlerts@SecAlertsCo90d
Patch
🎯 Prebid Server (CVSS 10): CVE-2026-54735 lets attackers inject SSRF via bid request params interpolated into outbound URLs — exposing host environment data. No auth, network-accessible. Patch now. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-54735?utm_campaign=x https://t.co/wUZbgAzS0v
Post summary
A CVE in Prebid Server allows unauthenticated SSRF that can expose host environment data; a patch is available.
00000102
872 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-54735 Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server int… https://www.cve.org/CVERecord?id=CVE-2026-54735 ----- Traducción: CVE-2026-54735 Pre… http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-54735) affecting Prebid Server before version 4.4.0 has been recorded, but no further details on exploitation or mitigations are provided.
0000027
96 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-54735 Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server int… https://www.cve.org/CVERecord?id=CVE-2026-54735
Post summary
The post refers to CVE-2026-54735 for Prebid Server prior to version 4.4.0 but offers only a generic reference to the CVE record without further technical, exploit, or mitigation details.
00000445
57.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	prebid	prebid_server	-	go	-

Explore more

Back to dashboard prebid CVEs prebid_server vulnerabilities

What researchers are saying

CVE-2026-54735

Aretiq.AI[verified]@AretiqAIDisclosure

A vulnerability bulletin announcing 28 critical/high CVEs, with brief technical details and a note that a PoC exists for one vulnerability, but no exploitation or patch information.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post announces a critical SSRF vulnerability (CVE‑2026‑54735) in Prebid Server (bidder adapters) and recommends upgrading to version 4.4.0. No PoC, exploit, or active exploitation is mentioned.

LibTracker@libtracker_ioDisclosure

The post notes CVE-2026-54735 as a request forgery vulnerability in prebid-server that could enable extraction of host environment data.

SecAlerts@SecAlertsCoPatch

A CVE in Prebid Server allows unauthenticated SSRF that can expose host environment data; a patch is available.

Infoflowcloud@infoflowcloudDisclosure

A new CVE (CVE-2026-54735) affecting Prebid Server before version 4.4.0 has been recorded, but no further details on exploitation or mitigations are provided.

CVE@CVEnewDisclosure

The post refers to CVE-2026-54735 for Prebid Server prior to version 4.4.0 but offers only a generic reference to the CVE record without further technical, exploit, or mitigation details.