Vulnerabilities ›

CVE-2026-33182

High

CWE-522 — Weakness Type

                    Published: Mar 26, 2026                      ·  Modified: Apr 2, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL, the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix in version 4.0.0 is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis.

🤖 AI Executive Summary

CVE-2026-33182 is a critical SSRF vulnerability in Saloon PHP library versions prior to 4.0.0 that allows attackers to redirect API requests to attacker-controlled hosts, potentially leaking authentication credentials and sensitive data. The vulnerability exploits improper URL validation when endpoints are user-influenced or configuration-driven. Organizations using affected Saloon versions in API integrations face immediate risk of credential compromise and unauthorized data exfiltration.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 3, 2026 13:57

🇸🇦 Saudi Arabia Impact Assessment

Saudi financial institutions (SAMA-regulated banks, fintech companies) integrating third-party payment APIs or open banking solutions via Saloon face critical risk of credential leakage to attacker infrastructure. Government agencies (NCA, CITC) using Saloon for API integrations with citizen services or inter-agency communications could expose authentication tokens. Healthcare providers (MOH, private hospitals) leveraging Saloon for patient data APIs risk HIPAA-equivalent compliance violations. Telecom operators (STC, Mobily, Zain) using Saloon for billing or subscriber management APIs could leak customer authentication. Energy sector (ARAMCO, SEC) API integrations for operational technology monitoring are at risk. E-commerce and digital payment platforms are particularly vulnerable if redirect_uri or callback URLs are user-configurable.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare and Medical Services Energy and Utilities Telecommunications E-commerce and Digital Payments Fintech and Digital Banking Insurance

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1557 - Man-in-the-Middle (credential interception) T1598 - Phishing (via compromised callback URLs) T1021 - Remote Services (SSRF to internal systems) T1040 - Traffic Capture or Replay (credential capture) T1111 - Multi-Stage Channels (exfiltration via attacker host) T1071 - Application Layer Protocol (HTTP/HTTPS abuse)

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Audit all Saloon library implementations across your organization to identify versions prior to 4.0.0

2. Identify all endpoints that accept user-influenced or configuration-driven URLs (redirect_uri, callback_url, webhook_url parameters)

3. Implement network segmentation to restrict outbound API calls to whitelisted domains only

4. Review authentication logs for suspicious outbound requests to unknown hosts

5. Rotate all API tokens, OAuth credentials, and authentication headers used by affected connectors

PATCHING GUIDANCE:

1. Upgrade Saloon library to version 4.0.0 or later immediately

2. After upgrade, explicitly opt-in to absolute URL functionality only where necessary using per-connector or per-request configuration

3. Implement strict URL validation: reject any endpoint parameter that contains a scheme (http://, https://) unless explicitly whitelisted

4. Use URLHelper::join() validation to enforce relative URLs only

COMPENSATING CONTROLS (if immediate patching not possible):

1. Implement proxy-based request filtering: route all Saloon API calls through a WAF/proxy that validates destination URLs against whitelist

2. Use network firewall rules to restrict outbound connections from application servers to known API endpoints only

3. Implement request header inspection: log and alert on any requests containing authentication headers destined for non-whitelisted hosts

4. Deploy SSRF detection: monitor for requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1) or cloud metadata endpoints

DETECTION RULES:

1. Monitor application logs for URLHelper::join() exceptions or InvalidArgumentException errors

2. Alert on outbound HTTP/HTTPS requests from application servers to non-whitelisted domains

3. Detect requests containing Authorization, X-API-Key, or Bearer tokens destined for external hosts

4. Monitor for requests to 169.254.169.254 (AWS metadata), 169.254.170.2 (Azure metadata), or similar cloud metadata endpoints

5. Log all Saloon connector instantiations with absolute URLs or dynamic endpoint configuration

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تدقيق جميع تطبيقات مكتبة Saloon عبر المنظمة لتحديد الإصدارات السابقة للإصدار 4.0.0

2. تحديد جميع نقاط النهاية التي تقبل عناوين URL مؤثرة من المستخدم أو مدفوعة بالتكوين (معاملات redirect_uri و callback_url و webhook_url)

3. تنفيذ تقسيم الشبكة لتقييد استدعاءات API الصادرة إلى النطاقات المدرجة في القائمة البيضاء فقط

4. مراجعة سجلات المصادقة للطلبات الصادرة المريبة إلى مضيفين غير معروفين

5. تدوير جميع رموز API وبيانات اعتماد OAuth وعناوين المصادقة المستخدمة من قبل الموصلات المتأثرة

إرشادات التصحيح:

1. ترقية مكتبة Saloon إلى الإصدار 4.0.0 أو أحدث على الفور

2. بعد الترقية، قم بتفعيل وظيفة عنوان URL المطلق بشكل صريح فقط حيث لزم الأمر باستخدام تكوين لكل موصل أو لكل طلب

3. تنفيذ التحقق الصارم من عنوان URL: رفض أي معامل نقطة نهاية يحتوي على مخطط (http:// أو https://) ما لم يكن مدرجاً في القائمة البيضاء بشكل صريح

4. استخدام التحقق من URLHelper::join() لفرض عناوين URL النسبية فقط

الضوابط التعويضية (إذا لم يكن التصحيح الفوري ممكناً):

1. تنفيذ تصفية الطلبات القائمة على الوكيل: توجيه جميع استدعاءات Saloon API من خلال WAF/proxy يتحقق من عناوين URL الوجهة مقابل القائمة البيضاء

2. استخدام قواعد جدار الحماية للشبكة لتقييد الاتصالات الصادرة من خوادم التطبيقات إلى نقاط نهاية API المعروفة فقط

3. تنفيذ فحص رأس الطلب: تسجيل والتنبيه على أي طلبات تحتوي على رؤوس مصادقة موجهة إلى مضيفين غير مدرجين في القائمة البيضاء

4. نشر كشف SSRF: مراقبة الطلبات إلى نطاقات IP الداخلية أو نقاط نهاية بيانات التعريف السحابية

قواعد الكشف:

1. مراقبة سجلات التطبيق لاستثناءات URLHelper::join() أو InvalidArgumentException

2. التنبيه على طلبات HTTP/HTTPS الصادرة من خوادم التطبيقات إلى نطاقات غير مدرجة في القائمة البيضاء

3. كشف الطلبات التي تحتوي على رموز Authorization أو X-API-Key أو Bearer موجهة إلى مضيفين خارجيين

4. مراقبة الطلبات إلى نقاط نهاية بيانات التعريف السحابية

5. تسجيل جميع تطبيقات موصل Saloon بعناوين URL مطلقة أو تكوين نقطة نهاية ديناميكي

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.14.2.1 - Information security requirements for supplier relationships (third-party API integrations) ECC 2024 A.8.3.2 - User access management and authentication controls ECC 2024 A.13.1.3 - Segregation of networks and network security controls ECC 2024 A.12.6.1 - Management of technical vulnerabilities

🔵 SAMA CSF

SAMA CSF ID.AM-2 - Software and hardware inventory (Saloon library versions) SAMA CSF PR.AC-1 - Access control policy and procedures SAMA CSF PR.DS-2 - Data-in-transit protection (credential leakage prevention) SAMA CSF DE.CM-1 - Detection processes and tools (SSRF monitoring)

🟡 ISO 27001:2022

ISO 27001:2022 A.5.23 - Information security for supplier relationships ISO 27001:2022 A.8.2 - User registration and access management ISO 27001:2022 A.8.3 - Access control and authentication ISO 27001:2022 A.14.2 - Supplier security assessment and monitoring

🟣 PCI DSS v4.0.1

PCI DSS 3.2.1 - Render PAN unreadable (credential protection) PCI DSS 4.1 - Use strong cryptography and security protocols (API authentication) PCI DSS 6.2 - Security patches and updates PCI DSS 6.5.10 - Broken authentication and session management

🔗 References & Sources 2

🔗

https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4

security-advisories@github.com

Release Notes

🔗

https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp

security-advisories@github.com

Vendor Advisory

📦 Affected Products / CPE 1 entries

saloon:saloon

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityN — None / Network

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-522

EPSS0.03%

Exploit No

Patch ✗ No

Published 2026-03-26

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

CWE-522

🏢 Vendor Advisories

🔗 https://github.com/saloonphp/saloon/security/advisor...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-33182

💬 Comments

Introduce Yourself

Sign In Required