CVE-2026-3270: PSI Probe Server-Side Request Forgery Vulnerability
Summary
CVE-2026-3270: PSI Probe vulnerable to Server-Side Request Forgery. Affects com.github.psi-probe:psi-probe-core versions < 5.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PSI Probe is an open-source monitoring tool for Java applications, designed to provide insights into the performance and health of web applications. It allows users to monitor various metrics and manage application settings through a user-friendly interface. However, versions up to 5.3.0 of PSI Probe contain a vulnerability that exposes the application to server-side request forgery (SSRF), enabling attackers to manipulate requests to internal services.
Vulnerability Detail
The vulnerability stems from the function lookup in the Whois component of PSI Probe, specifically located in the file psi-probe-core/src/main/java/psiprobe/tools/Whois.java. This flaw allows an attacker to craft requests that can be sent to internal services, potentially leading to unauthorized access to sensitive data or services. The attack can be initiated remotely, making it a significant risk for users of the affected versions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider restricting network access to the PSI Probe application to limit exposure to potential SSRF attacks. Implementing firewall rules to block unauthorized external access can help mitigate the risk temporarily.
Conclusion
The CVE-2026-3270 vulnerability in PSI Probe exposes users to server-side request forgery risks, which can lead to unauthorized access to sensitive internal services. It is crucial to update to the patched version 5.3.1 or later to protect against this vulnerability. Users can also utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for com.github.psi-probe:psi-probe-core →
FAQ
SSRF is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data leakage.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your pom.xml file, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability could allow attackers to access internal services, potentially leading to data breaches or unauthorized actions within the application.
Yes, a patch is available in version 5.3.1 of PSI Probe. It is recommended to update to this version or later to mitigate the vulnerability.
If you cannot update right away, consider implementing network restrictions to limit access to the PSI Probe application and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for com.github.psi-probe:psi-probe-core.
