CVE-2026-54735
Critical
Description
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
SeverityCritical
CVSS10.0
Exploit probability—
Product
Prebid Server
PublishedJul 29, 2026
First seenJul 29, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- prebid prebid_server4.4.0 or later
- github.com/prebid/prebid-server/v44.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prebid prebid_server | v < 4.4.0 | 4.4.0 |
| github.com/prebid/prebid-server/v4Go | v < 4.4.0 | 4.4.0 |
| github.com/prebid/prebid-server/v3Go | v ≤ 3.30.0 | — |
| github.com/prebid/prebid-server/v2Go | v ≤ 2.32.0 | — |
| github.com/prebid/prebid-serverGo | v ≤ 0.275.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.