[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:owasp\u002Ftop10-2021-a10":3},{"item":4,"lessons":16,"controls":31,"related":57},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"owasp","top10-2021-a10","A10:2021","A10:2021 Server-Side Request Forgery (SSRF)",2,"OWASP Foundation","**What it asks for.** This category covers flaws where a web application fetches a remote resource based on a URL supplied by the user without validating it. An attacker can then make the server send requests to internal systems, cloud metadata services or other destinations that should not be reachable.\n\n**In practice.** Strong defences combine network and application controls. At the network layer, the components that make outbound requests are segmented and restricted with deny-by-default egress rules. In the application, user-supplied URLs are validated against an allow list of schemes, hosts and ports, redirects are not followed blindly, and raw responses are not returned to the client. Cloud instance metadata services are hardened, for example by requiring session tokens. Evidence includes code review findings, security tests covering SSRF payloads and documented egress rules.\n\n**Common gaps.** Teams often rely on deny lists or regular expressions that can be bypassed with alternative IP encodings, DNS rebinding or redirects. Webhooks, file importers and URL preview features are frequently overlooked.",null,"https:\u002F\u002Fowasp.org\u002FTop10\u002FA10_2021-Server-Side_Request_Forgery_%28SSRF%29\u002F","Read it at OWASP","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},3,[19,23,27],{"slug":20,"title":21,"published_at":22},"ssrf-flaw-in-aws-mcp-gateway-exposed-internal-networks-and-cloud-credentials","SSRF Flaw in AWS MCP Gateway Exposed Internal Networks and Cloud Credentials","2026-11-12T14:21:00.195+00:00",{"slug":24,"title":25,"published_at":26},"active-mlflow-ssrf-exploit-highlights-urgent-patch-prioritization-need","Active MLflow SSRF Exploit Highlights Urgent Patch Prioritization Need","2026-08-19T20:21:24.06+00:00",{"slug":28,"title":29,"published_at":30},"critical-ssrf-flaw-in-ohif-dicom-viewer-exposes-clinician-tokens","Critical SSRF Flaw in OHIF DICOM Viewer Exposes Clinician Tokens","2026-06-25T18:20:56.592+00:00",[32,36,40,45,49,53],{"slug":33,"name":34,"problem":35,"stories":17},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":37,"name":38,"problem":39,"stories":9},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":41,"name":42,"problem":43,"stories":44},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":46,"name":47,"problem":48,"stories":44},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":50,"name":51,"problem":52,"stories":44},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":54,"name":55,"problem":56,"stories":44},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,63,68,72,76,81,85,89],{"family":59,"item":60,"code":61,"title":62,"together":17},"cis","7","Control 7","Continuous Vulnerability Management",{"family":64,"item":65,"code":66,"title":67,"together":9},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":64,"item":69,"code":70,"title":71,"together":9},"sc-7","SC-7","Boundary Protection",{"family":59,"item":73,"code":74,"title":75,"together":9},"12","Control 12","Network Infrastructure Management",{"family":77,"item":78,"code":79,"title":80,"together":44},"nis2","21-2-e","Article 21(2)(e)","Security in acquisition, development and maintenance (Article 21(2)(e))",{"family":64,"item":82,"code":83,"title":84,"together":44},"ac-17","AC-17","Remote Access",{"family":64,"item":86,"code":87,"title":88,"together":44},"ac-6","AC-6","Least Privilege",{"family":64,"item":90,"code":91,"title":92,"together":44},"si-10","SI-10","Information Input Validation"]