CVE-2026-11424: Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure

Synopsis

A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated attacker can submit a crafted GraphQL request that causes the server to issue an outbound HTTP GET to an attacker-controlled URL, with the response body returned directly to the attacker. This enables access to internal services and cloud metadata endpoints (such as AWS IMDSv1 or similar) that are not reachable from the public internet, resulting in information disclosure and internal infrastructure reconnaissance. A patched-image rebuild at version 8.1.1 is available on HarborGuard for environments running an affected version of Altium Enterprise Server.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable GraphQL endpoint must be reachable over the network; an attacker sends the crafted request directly to the exposed service.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no elevated or administrative role is needed to submit the malicious GraphQL request.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the request directly to the server without involving another user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required.

Blast Radius

• Reads the response body of internal HTTP services not exposed to the public network, including service discovery endpoints and internal APIs.
• Retrieves cloud instance metadata (for example, temporary IAM credentials from a cloud provider metadata service) if the host runs in a cloud environment without metadata endpoint protection.
• Enables mapping of internal network topology and service ports by probing internal address ranges through the server's HTTP GET primitive.
• No write or availability impact is possible through this vulnerability; the attack primitive is limited to read-only HTTP GET requests with no custom header injection.