CVE-2026-33182: Saloonphp/saloon Saloon Is Vulnerable To SSRF Vulnerability

MODERATE
Advisory Identifier: GHSA-c83f-3xp6-hfcp
Share
CWE-522 CWE-918
Published
Advisory Summary

CVE-2026-33182 is a MODERATE saloon is vulnerable to ssrf vulnerability (CWE-522: Insufficiently Protected Credentials) affecting Saloonphp/saloon libraries in the Packagist ecosystem. The issue involves saloon is vulnerable to ssrf and credential leakage via absolute url in endpoint overriding base url. Remediation is available by upgrading affected packages to version 4.0.0.

CVE-2026-33182 at a Glance

CVE Identifier CVE-2026-33182
GHSA Identifier GHSA-c83f-3xp6-hfcp
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-522: Insufficiently Protected Credentials
Affected Product Saloonphp/saloon
Package Ecosystem Packagist
Published Date
Last Updated

How to Fix CVE-2026-33182

To remediate this vulnerability, upgrade all affected Saloonphp/saloon dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

saloonphp/saloon fixed: 4.0.0 
Upgrade saloonphp/saloon to 4.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for saloonphp/saloon

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-33182, inspect your project dependencies for Saloonphp/saloon:

inspect dependencies for saloonphp/saloon

Analyze the terminal output to locate any version of Saloonphp/saloon in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.0.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-522: Insufficiently Protected Credentials, where the product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. In Saloonphp/saloon, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Users providing user generated input into the `resolveEndpoint` method on requests. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description When building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL (e.g. https://attacker.example.com/callback), the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix (in the next major version) is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis. ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.

CVE-2026-33182 Affected Saloonphp/saloon Versions

1 component(s)
Fixed Versions:
4.0.0
Product / Package Ecosystem Affected Versions Fixed Version
saloonphp/saloon
 Packagist
< 4.0.0
4.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp
NVD — CVE-2026-33182 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33182
docs.saloon.dev/upgrade/upgrading-f... WEB
https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
Saloonphp/saloon Source Repository REPOSITORY
https://github.com/saloonphp/saloon

Frequently Asked Questions

What is CVE-2026-33182?
CVE-2026-33182 is a security vulnerability in Saloonphp/saloon involving Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL under CWE-522: Insufficiently Protected Credentials.
Which Saloonphp/saloon versions are affected?
Affected versions include releases prior to 4.0.0 across affected packages: saloonphp/saloon.
What version fixes CVE-2026-33182?
Upgrading to 4.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is saloonphp/saloon affected?
Yes, saloonphp/saloon is affected in releases prior to 4.0.0. Upgrade your dependency to 4.0.0 or later.
What CWE is associated with CVE-2026-33182?
CVE-2026-33182 is classified under CWE-522: Insufficiently Protected Credentials (The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.).
How can I check Packagist dependencies for CVE-2026-33182?
Run the dependency tree command: 'inspect dependencies for saloonphp/saloon'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c83f-3xp6-hfcp",
  "modified" : "2026-03-30T13:53:47Z",
  "published" : "2026-03-25T22:00:13Z",
  "aliases" : [ "CVE-2026-33182" ],
  "summary" : "Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL",
  "details" : "### Impact\nUsers providing user generated input into the `resolveEndpoint` method on requests.\n\n### Patches\nUpgrade to Saloon v4+\n\nUpgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4\n\n### Description\nWhen building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL (e.g. https://attacker.example.com/callback), the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix (in the next major version) is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis.\n\n### Credits\nSaloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "saloonphp/saloon"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33182"
  }, {
    "type" : "WEB",
    "url" : "https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/saloonphp/saloon"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-522", "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-25T22:00:13Z",
    "nvd_published_at" : "2026-03-26T01:16:27Z"
  }
}