AIKIDO-2026-284345
rack-proxy is vulnerable to Server-Side Request Forgery (SSRF)
78
High Risk
This Affects:
rack-proxyTL;DR
When no backend is explicitly configured, Rack::Proxy forwards requests to the host and port taken from the client-supplied Host header instead of refusing them. A bare deployment therefore becomes an open proxy that can reach internal or cloud-internal services. The fix refuses Host-derived backends by default (returning 502) unless allow_dynamic_backend: true is set, and adds a backend_allowed? hook for allowlisting destinations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you mount Rack::Proxy or a subclass without always supplying a static :backend (or rack.backend) option.
Background info
rack-proxy is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 0.8.3.
How to fix this
Upgrade the rack-proxy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant