CVE-2026-42860
Description
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_source. An authenticated user with the Enterprise Admin role can set this field to an arbitrary URL via the SAMLProviderConfigViewSet PATCH endpoint, then trigger a server-side HTTP request by calling sync_provider_data. The fetch in fetch_metadata_xml() passes the URL directly to requests.get() with no scheme enforcement, IP filtering, or timeout. This vulnerability is fixed in 7.0.5.
How to fix
- openedx edx-enterprise7.0.5 or later
- edx-enterprise7.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openedx edx-enterprise | 7.0.2 ≤ v < 7.0.5 | 7.0.5 |
| edx-enterprisePyPI | 7.0.2 ≤ v < 7.0.5 | 7.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.