‹ Back to list

CVE-2026-55414

Status: DeferredMedium (5.3)—
Severity5.3Medium · CVSS 3.1
Exploitation probability0.44 %higher than 37% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token.

Read full descriptionShow less

The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

CVSS

Base score
5.3
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.44 %
Percentile among all scored CVEs
37
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Resolvers GraphQL sin autenticación reenvían una URL controlable al host de Objecten-API con el token adjunto, sin limitar esquema, puerto ni ruta (SSRF); la captura del token exige routing controlado en ese host.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Filter Network TrafficPrivileged Account ManagementLimit Access to Resource Over NetworkUpdate SoftwareActive Directory ConfigurationVulnerability Scanning

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

NL Portal Backend Libraries — NL Portal Backend LibrariesAI

CWEs

References

Show 5 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-55414",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55414",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-15T18:25:48.650492Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nl-portal",
          "product": "nl-portal-backend-libraries",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.1.0, < 3.0.4"
            },
            {
              "status": "affected",
              "version": "= 3.1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-15T18:17:27.503",
  "references": [
    {
      "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/700",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release."
    }
  ],
  "lastModified": "2026-10-16T20:04:29.760",
  "sourceIdentifier": "security-advisories@github.com"
}