Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54735.
Unlock with Pro - from £29/user/moDetect Prebid Server SSRF via Request Forgery (CVE-2026-54735) in IBM QRadar
Detects exploitation of CVE-2026-54735, a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in prebid/prebid-server affecting versions < 4.4.0, <= 3.30.0, <= 2.32.0, and <= 0.275.0. The flaw (CWE-918) allows an attacker to craft bid request or adapter/URL parameters that cause the prebid-server host to issue outbound requests to attacker-controlled or internal/cloud-metadata endpoints, potentially exfiltrating host environment data (cloud metadata credentials, internal service responses). Detection focuses on anomalous outbound HTTP requests originating from prebid-server processes/containers to internal RFC1918 ranges, loopback, link-local cloud metadata IPs (169.254.169.254), or unexpected external hosts triggered by bid/adapter request handling.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, destinationip, URL(payload) as request_path, COUNT(*) as event_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%prebid%'
AND (destinationip = '169.254.169.254'
OR INCIDR(destinationip, '10.0.0.0/8')
OR INCIDR(destinationip, '172.16.0.0/12')
OR INCIDR(destinationip, '192.168.0.0/16')
OR INCIDR(destinationip, '127.0.0.0/8'))
AND (payload ILIKE '%/openrtb2/auction%' OR payload ILIKE '%/openrtb2/amp%' OR payload ILIKE '%/setuid%' OR payload ILIKE '%/cookie_sync%')
GROUP BY sourceip, destinationip, request_path
HAVING COUNT(*) > 1
LAST 24 HOURSQRadar AQL query identifying prebid-server events where auction/amp/setuid/cookie_sync request handling produced connections to metadata or internal IP ranges, indicating SSRF exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Intended internal adapter configurations
- Automated internal health checks
- Proxy/mesh traffic through internal ranges
- Non-production environments with internal mock adapters
Other platforms for CVE-2026-54735
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SSRF request to cloud metadata endpoint via crafted auction request
Expected signal: Outbound HTTP connection from prebid-server process to 169.254.169.254 logged in network flow/access logs with source path /openrtb2/auction
- Test 2Simulate SSRF probe to internal RFC1918 service via cookie_sync endpoint
Expected signal: Outbound HTTP connection from prebid-server process to internal IP 10.0.0.5 logged with request path /cookie_sync
- Test 3Version fingerprint check against vulnerable prebid-server release
Expected signal: HTTP GET request to /status or /version endpoint logged in prebid-server access logs
- Test 4Simulate repeated metadata-scanning pattern via openrtb2/amp endpoint
Expected signal: Multiple outbound HTTP connections from prebid-server process to distinct internal/metadata IPs within a short time window, logged with request path /openrtb2/amp
References (5)
- https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
- https://github.com/prebid/prebid-server/pull/4802
- https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
- https://github.com/prebid/prebid-server/releases/tag/v4.4.0
- https://github.com/advisories/GHSA-4p3g-4hcj-wpvx
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54735 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month