Adobe Content Credentials SDK: Server-Side Request Forgery
Summary
Adobe Content Credentials SDK components (Rust SDK, C2PA Tool and JS SDK) contain a Server-Side Request Forgery (SSRF) vulnerability, CWE-918, rated High with CVSS 8.6. Adobe's bulletin describes the impact as security feature bypass, while the CVE record mentions possible privilege escalation; the exact impact is still to be confirmed by the vendor. No user interaction is required for exploitation, and the scope is changed. The practical risk exists mainly where an internet-facing service or pipeline embeds the SDK and processes remote or user-supplied manifests or URLs.
Affected
- Content Credentials Rust SDK (c2pa) up to and including c2pa-v0.90.15
- C2PA Tool (c2patool) up to and including c2patool-v0.27.15
- Content Credentials JS SDK (@contentauth/c2pa-web) up to and including 0.13.4
- Platform: All
Fixed in
- Content Credentials Rust SDK: c2pa-v0.91.1 (listed as unaffected by the CVE record; not explicitly confirmed as fix for this CVE in the vendor text reviewed)
- C2PA Tool: c2patool-v0.28.1 (same caveat)
- Content Credentials JS SDK: @contentauth/c2pa-web@0.15.3 (same caveat)
Workaround
Unknown.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- No public proof of concept found.
- Not listed in CISA KEV according to a third-party tracker.
Our recommendation
- Inventory whether any in-house tools, web services or third-party products embed c2pa-rs, c2patool or c2pa-web.
- Check whether these services can fetch arbitrary URLs or process untrusted manifests.
- Update to the newest release of each component you use, and confirm the fixed version with Adobe or the APSB26-163 bulletin.
- Prioritise internet-facing services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-163 www.adobe.com
- CVE record mirror (threatint) cve.threatint.com
- Zero Day Initiative October 2026 review www.zerodayinitiative.com
- Strix CVE entry www.strix.ai
- c2pa-rs release c2pa-v0.91.1 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:16.
Original description (NVD)
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.