CVE-2026-58346

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. MNet (Moodle Networking) connects a Moodle site to other Moodle or Mahara sites, called peers, for single sign-on and shared services. Site administrators add peers on the Manage peers page by entering the peer's address, and Moodle then contacts that address to fetch the peer's name and public key.

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-58346) has been identified in the MNet peer management page of Moodle and IOMAD, which allows a site administrator to make the server send requests to hosts that the cURL blocked hosts and allowed ports settings are meant to keep it away from. The feature is available only to site administrators. Moodle tracks this issue as MSA-26-0027 (MDL-87911).

Per OWASP: The target application may have functionality for importing data from a URL, publishing data to a URL or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.). When the manipulated request goes to the server, the server-side code picks up the manipulated URL and tries to read data to the manipulated URL.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mnet/peer.php, admin/mnet/peer_forms.php)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

When an administrator adds a peer in admin/mnet/peers.php, the page calls mnet_peer::bootstrap() with the address from the form. For a new address, bootstrap() resolved the host name and went on to contact it without checking the address against the cURL blocked hosts list:

// If a peer record already exists for this address,
// load that info and return
if ($this->set_wwwroot($wwwroot)) {
    return true;
}

$hostname = mnet_get_hostname_from_uri($wwwroot);
// Get the IP address for that host - if this fails, it will return the hostname string
$ip_address = gethostbyname($hostname);

Later in the same method, mnet_get_public_key() sends an XML-RPC system/keyswap request to the peer address. It builds that request with the bundled PhpXmlRpc client set to use cURL directly, not Moodle's curl class, so the cURL blocked hosts and allowed ports settings never applied to it. The add host form in admin/mnet/peer_forms.php did not check the address either.

An administrator can therefore enter an internal address, such as a loopback, private network, or cloud metadata address, and Moodle sends a request to it. The response is not shown to the administrator, which makes this a blind SSRF: it can be used to probe which internal hosts and ports respond, or to send a request to an internal service. Only site administrators can reach the peer management page, so the risk matters mainly where the server's network is meant to be off limits even to Moodle administrators, such as hosted or multi-tenant installations.

The fix runs the cURL security check in two places. The add host form now rejects a blocked address during validation, and bootstrap() itself throws an exception before any lookup or request. The second check also covers the code path in peers.php that calls bootstrap() with wwwroot and applicationid URL parameters, which does not go through the form validation:

$securityhelper = new \core\files\curl_security_helper();
if ($securityhelper->url_is_blocked($wwwroot)) {
    throw new moodle_exception('curlsecurityurlblocked', 'admin');
}

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• DangKhai of VPBank Security Team (finder)