What is CVE-2026-53508?

CVE-2026-53508 is a medium-severity server-side request forgery (SSRF) vulnerability in github.com/oasdiff/oasdiff (go), affecting versions >= 1.13.2, <= 1.18.0. It is fixed in 1.18.1. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.

Which versions of github.com/oasdiff/oasdiff are affected by CVE-2026-53508?

github.com/oasdiff/oasdiff (go) versions >= 1.13.2, <= 1.18.0 is affected.

Is there a fix for CVE-2026-53508?

Yes. CVE-2026-53508 is fixed in 1.18.1. Upgrade to this version or later.

Is CVE-2026-53508 exploitable, and should I be worried?

Whether CVE-2026-53508 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-53508 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-53508?

Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.

CVE-2026-53508 in github.com/oasdiff/oasdiff

Q: Which versions of github.com/oasdiff/oasdiff are affected by CVE-2026-53508?

github.com/oasdiff/oasdiff (go) versions >= 1.13.2, <= 1.18.0 is affected.

Q: Is there a fix for CVE-2026-53508?

Yes. CVE-2026-53508 is fixed in 1.18.1. Upgrade to this version or later.

Q: Is CVE-2026-53508 exploitable, and should I be worried?

Whether CVE-2026-53508 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-53508 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-53508?

Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.

Summary

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

From v1.13.2 through v1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.

Workarounds

Upgrade to v1.18.1, or
Avoid the git-revision input form when processing untrusted specs with external refs disabled.

Notes

Introduced in v1.13.2 (#832, which added $ref-chain resolution on the git-revision path); fixed in v1.18.1 (#974, #975).
The permissive default (allow-external-refs: true) and its zero-interaction exposure in CI via the GitHub Action is tracked separately in GHSA-fhj3-7267-7vv5 (oasdiff-action).

Impact

A caller who set --allow-external-refs=false specifically to safely process untrusted specs remained exposed, on the git-revision load path only, to:

SSRF via $ref: "http://<internal-host>/…", and
Local file reads via $ref: "/path" or file://.

Affected callers:

CLI: oasdiff diff main:openapi.yaml HEAD:openapi.yaml --allow-external-refs=false (and breaking / changelog / summary, and the git-diff-driver) run over untrusted spec content.
Go library consumers of github.com/oasdiff/oasdiff/load that set IsExternalRefsAllowed = false and load from a git-revision source via load.NewSpecInfo.

The file and URL load paths correctly enforced the setting; only the git-revision path was affected. Callers that left external refs at the default (true) are not in scope for this advisory.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

Affected versions

github.com/oasdiff/oasdiff (>= 1.13.2, <= 1.18.0)

Security releases

github.com/oasdiff/oasdiff → 1.18.1 (go)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

v1.18.1 enforces the external-refs policy on the git-revision path (so --allow-external-refs=false now blocks external $refs there) and returns a dedicated exit code (123) when an external $ref is refused.

Frequently Asked Questions

What is CVE-2026-53508? CVE-2026-53508 is a medium-severity server-side request forgery (SSRF) vulnerability in github.com/oasdiff/oasdiff (go), affecting versions >= 1.13.2, <= 1.18.0. It is fixed in 1.18.1. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
Which versions of github.com/oasdiff/oasdiff are affected by CVE-2026-53508? github.com/oasdiff/oasdiff (go) versions >= 1.13.2, <= 1.18.0 is affected.
Is there a fix for CVE-2026-53508? Yes. CVE-2026-53508 is fixed in 1.18.1. Upgrade to this version or later.
Is CVE-2026-53508 exploitable, and should I be worried? Whether CVE-2026-53508 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-53508 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-53508? Upgrade github.com/oasdiff/oasdiff to 1.18.1 or later.