# CVE-2020-36851: Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRF

Status: published. Published: 2025-09-25. Updated: 2026-11-08.

Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services, retrieve instance role credentials or other sensitive metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is exploitable by sending crafted requests to the proxy with the target resource encoded in the URL; many cors-anywhere deployments forward arbitrary methods and headers (including PUT), which can permit exploitation of IMDSv2 workflows as well as access to internal management APIs. Successful exploitation can result in theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation (depending on reachable backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods/headers, enabling cloud provider mitigations, and deploying network-level protections.

## Remediation

- workaround: Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods/headers, enabling cloud provider mitigations, and deploying network-level protections. (source: CNA: VulnCheck)

## Affected products and versions

- Rob--W / cors-anywhere / Rob--W / cors-anywhere (cors-anywhere): ≥ 0; ≤ 0.4.4 (affected, semver). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 9.5 (critical); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: 0.83% as of 2026-11-08; percentile 57.75%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-942, CWE-918

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Rob--W/cors-anywhere/issues/152 (CNA: VulnCheck; issue-tracking)

- https://github.com/Rob--W/cors-anywhere/issues/78 (CNA: VulnCheck; issue-tracking)

- https://www.certik.com/resources/blog/cors-anywhere-dangers-of-misconfigured-third-party-software (CNA: VulnCheck; technical-description)

- https://www.vulncheck.com/advisories/rob-w-cors-anywhere-misconfigured-cors-proxy-allows-ssrf (CNA: VulnCheck; third-party-advisory)

- https://github.com/SocketDev/security-research/security/advisories/GHSA-9wmg-93pw-fc3g (CNA: VulnCheck; vendor-advisory)

- https://github.com/Rob--W/cors-anywhere/issues/521 (CNA: VulnCheck; issue-tracking)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2020-36851; retrieved 2026-11-08; source updated 2026-11-08

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2020-36851; retrieved 2026-11-08; source updated Not reported

Revision: d8b0b42bd734c8d766f7e335071df59d22faab1b243f34eb75cb7b9583c174b9

Canonical: https://y2.dev/cve/CVE-2020-36851

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.