SSRF in Cisco Nexus Dashboard
CVE-2026-20041
A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by persuading an authenticated user of the device management interface to click a crafted link. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device to an attacker-controlled server. The attacker could then execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (14.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Cisco Nexus Dashboard — versions 1.1(3e), 1.1(3c), 1.1(3d)
- Cisco Nexus Dashboard Insights — versions 2.2.2.125, 2.2.2.126, 5.0.1.150
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-20041?
- CVE-2026-20041 is a medium-severity vulnerability in Cisco Nexus Dashboard, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.1/10. Published 2026-04-01.
- How severe is CVE-2026-20041?
- Medium severity. CVSS v3 base score is 6.1 out of 10.