Critical Prebid Server Flaw Exposes Data

Prebid Server users face a critical security risk identified as CVE-2026-54735, which carries a maximum CVSS score of 10. The vulnerability allows for request forgery, potentially enabling an attacker to extract data from the host environment by manipulating outbound HTTP requests.

What's at Risk

The flaw affects the go/github.com/prebid/prebid-server/v4 package, which has received a patch in version 4.4.0. Users of older versions, including v3, v2, and the base prebid-server package, remain vulnerable as no patches are currently available for these branches. Organizations running internet-facing instances of this software are at the highest level of risk, as the server acts as an intermediary that processes external requests.

How the Flaw Works

This vulnerability falls under the class of request forgery. Typically, this type of weakness occurs when an application processes user-supplied input to construct network requests without sufficient validation or sanitization. In a general context, an attacker can exploit this by injecting malicious parameters that force the application to interact with internal resources that are otherwise unreachable from the public internet. By redirecting the server to target internal services, such as local configuration endpoints, metadata services, or private APIs, an attacker may be able to bypass network perimeters, exfiltrate sensitive environment variables, or gain unauthorized access to backend infrastructure.

How to Protect Your Systems

• Upgrade to prebid-server version 4.4.0 immediately to resolve the vulnerability in the v4 branch.
• Disable any affected bidder adapters if you are unable to apply the official patch to your deployment.
• Restrict outbound network access for the server to only known, required endpoints to mitigate the impact of potential forgery attempts.
• Implement strict input validation and allow-listing for all parameters passed to bidder adapters to prevent unauthorized URL manipulation.
• Regularly monitor server logs for suspicious outbound connection attempts or requests directed toward internal IP ranges.

Given the critical severity rating of this vulnerability, immediate action is required to secure affected environments. Because the flaw allows for potential host environment data extraction, any delay in patching or disabling vulnerable adapters significantly increases the likelihood of unauthorized access to internal infrastructure. Prioritize the update to version 4.4.0 to neutralize this critical security threat.