Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54735.

Unlock with Pro - from £29/user/mo
CVE-2026-54735 Microsoft Sentinel · KQL

Detect Prebid Server SSRF via Request Forgery (CVE-2026-54735) in Microsoft Sentinel

Detects exploitation of CVE-2026-54735, a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in prebid/prebid-server affecting versions < 4.4.0, <= 3.30.0, <= 2.32.0, and <= 0.275.0. The flaw (CWE-918) allows an attacker to craft bid request or adapter/URL parameters that cause the prebid-server host to issue outbound requests to attacker-controlled or internal/cloud-metadata endpoints, potentially exfiltrating host environment data (cloud metadata credentials, internal service responses). Detection focuses on anomalous outbound HTTP requests originating from prebid-server processes/containers to internal RFC1918 ranges, loopback, link-local cloud metadata IPs (169.254.169.254), or unexpected external hosts triggered by bid/adapter request handling.

MITRE ATT&CK

Tactic
Initial Access Collection Command and Control

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
// Requires prebid-server container/host network logs ingested (e.g., via AzureDiagnostics, custom table, or Defender for Cloud network flow logs)
let MetadataIps = dynamic(["169.254.169.254"]);
let InternalRanges = dynamic(["10.","172.16.","172.17.","172.18.","172.19.","172.2","172.30.","172.31.","192.168.","127."]);
PrebidServerHttpLogs_CL
| where ProcessName_s has "prebid-server" or Container_s has "prebid-server"
| where isnotempty(DestinationIP_s)
| extend IsMetadata = DestinationIP_s in (MetadataIps)
| extend IsInternal = InternalRanges has_any (pack_array(DestinationIP_s))
| where IsMetadata or IsInternal or RequestPath_s has_any ("/openrtb2/auction","/openrtb2/amp","/setuid","/cookie_sync")
| where RequestPath_s has_any ("/openrtb2/auction","/openrtb2/amp","/setuid","/cookie_sync") and (IsMetadata or IsInternal)
| project TimeGenerated, ProcessName_s, SourceIP_s, DestinationIP_s, RequestPath_s, UserAgent_s, HttpStatusCode_d
| summarize Count=count(), Paths=make_set(RequestPath_s), Destinations=make_set(DestinationIP_s) by SourceIP_s, bin(TimeGenerated, 5m)
| where Count > 1
critical severity medium confidence

Flags outbound requests from prebid-server processes to cloud metadata IP or internal/private IP ranges triggered by auction/amp/setuid/cookie_sync endpoints, indicative of SSRF exploitation via crafted bid or adapter URL parameters.

Data Sources

Network connection logsContainer/host process logsCustom prebid-server access logs

Required Tables

PrebidServerHttpLogs_CL

False Positives & Tuning

  • Legitimate internal adapter endpoints configured to call internal ad servers
  • Misconfigured monitoring/health-check tools polling metadata-like IPs
  • Load balancer or service mesh sidecars proxying through internal IPs
  • Test/staging environments intentionally pointing adapters at internal mock servers

Other platforms for CVE-2026-54735

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate SSRF request to cloud metadata endpoint via crafted auction request

    Expected signal: Outbound HTTP connection from prebid-server process to 169.254.169.254 logged in network flow/access logs with source path /openrtb2/auction

  2. Test 2Simulate SSRF probe to internal RFC1918 service via cookie_sync endpoint

    Expected signal: Outbound HTTP connection from prebid-server process to internal IP 10.0.0.5 logged with request path /cookie_sync

  3. Test 3Version fingerprint check against vulnerable prebid-server release

    Expected signal: HTTP GET request to /status or /version endpoint logged in prebid-server access logs

  4. Test 4Simulate repeated metadata-scanning pattern via openrtb2/amp endpoint

    Expected signal: Multiple outbound HTTP connections from prebid-server process to distinct internal/metadata IPs within a short time window, logged with request path /openrtb2/amp

Last updated: 2026-07-31 Research depth: standard
References (5)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-54735 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0009CollectionTA0011Command and Control

Related Techniques

T1190Exploit Public-Facing ApplicationT1552.005Cloud Instance Metadata APIT1595.002Vulnerability Scanning

Same Tactic: Initial Access

Popular Detections