CVE-2026-26379 — Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration

Matched remediation archetype

Server-side request forgery and unintended proxying

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Inventory server-side URL fetchers, webhooks, importers, previews, redirects, proxies, and protocol handlers reachable from untrusted input.
• Map egress paths to internal services, metadata endpoints, loopback, private address space, and privileged control planes.
• Review DNS resolution, redirect, proxy, credential-forwarding, and URL parsing behavior without requesting sensitive targets.

Remediate safely

• Replace arbitrary destinations with named integrations or a strict allowlist of schemes, hosts, ports, and paths.
• Resolve and validate every destination and redirect hop, then enforce egress policy independently of application checks.
• Remove ambient credentials and sensitive headers from fetchers; apply response size, time, and content limits.