SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) (CVE-2026-28329)
Summary
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
Affected Products
SolarWinds Observability Self-Hosted 2026.2.3 and below
Fixed Software Release
SolarWinds Observability Self-Hosted 2026.4
Acknowledgments
Dimitrios Titos from NATO
Georgios Sotiriadis from NATO
Frank Lycops from NATO
Advisory Details
Severity
6.4 Medium
Advisory ID
First Published
10/20/2026
Fixed Version