Prebid Server Bidder Adapters Vulnerable to Critical Server-Side Request Forgery (CVE-2026-54735)

What Happened

According to a GitHub Security Advisory (GHSA-4p3g-4hcj-wpvx) published on 2026-07-29, Prebid Server contains a server-side request forgery (SSRF) vulnerability tracked as CVE-2026-54735, carrying a maximum CVSS score of 10.0. The advisory states that certain bidder adapters accept user-supplied parameters that are interpolated directly into outbound request URLs without proper validation. A malicious actor could craft bid request parameters that cause the server to issue HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints.

The issue affects github.com/prebid/prebid-server across multiple major versions (v2, v3, v4, and unversioned module paths). A proof-of-concept is reportedly public. The vulnerability is patched in v4.4.0.

Why It Matters

Prebid Server is widely deployed by publishers and ad-tech operators to run server-side header bidding auctions, often sitting inside internal networks with access to backend services, metadata endpoints, and other adapters. An SSRF in this position could let an attacker use the server as a pivot to reach internal-only resources — cloud instance metadata services, internal APIs, or admin interfaces — that are not normally exposed externally. The maximum CVSS score and public PoC availability elevate the urgency, particularly for organizations running self-hosted Prebid Server instances with less-common or custom bidder adapters enabled.

What Defenders Should Do Now

• Identify all Prebid Server deployments and check the running version against v4.4.0.
• If immediate patching isn't feasible, disable any bidder adapters that are not strictly required, per the advisory's stated workaround.
• Review egress/network policies from Prebid Server hosts — restrict outbound access to cloud metadata endpoints (e.g., 169.254.169.254) and internal-only services where possible.
• Hunt for anomalous outbound HTTP requests originating from Prebid Server processes to unexpected internal IP ranges or metadata endpoints, especially correlated with unusual or malformed bid request parameters.
• Review logs for bid requests containing URL-like or IP-like values in adapter-specific parameter fields, which may indicate exploitation attempts.

Developing Intel

This is a same-day advisory and details may evolve as the community and Prebid maintainers publish further guidance. No detection content specific to this vulnerability has been developed by df00tech at this time. For the authoritative details, see the original advisory: GHSA-4p3g-4hcj-wpvx.