CVE-2026-54690: CVE-2026-54690: Server-Side Request Forgery in datamodel-code-generator Remote Schema Resolution

#security #cve #cybersecurity

CVE-2026-54690: Server-Side Request Forgery in datamodel-code-generator Remote Schema Resolution

Vulnerability ID: CVE-2026-54690
CVSS Score: 8.2
Published: 2026-07-28

CVE-2026-54690 (GHSA-954p-556p-r752) is a Server-Side Request Forgery (SSRF) vulnerability in the datamodel-code-generator Python library from version 0.9.1 to 0.61.0. The library silently resolves remote JSON Schema references ($ref) over HTTP/HTTPS without verifying the target hosts or IP addresses. Because it automatically follows redirects and permits requests to local and private networks by default, an attacker can submit a crafted schema to trigger connections to internal subnets, localhost, or cloud metadata endpoints. Retrieved sensitive data is subsequently parsed and reflected in the generated Python model files, resulting in local and private data disclosure.

TL;DR

A Server-Side Request Forgery (SSRF) flaw in datamodel-code-generator allows remote attackers to read sensitive internal network and host configurations (such as cloud instance metadata) by submitting schemas containing malicious remote references.

Technical Details

CWE ID: CWE-918
Attack Vector: Network
CVSS Base Score: 8.2 (High)
Exploit Status: PoC Available
Affected Versions: >= 0.9.1, < 0.61.0
Mitigation Option: Upgrade to 0.61.0 or disable remote references

Affected Systems

datamodel-code-generator

Mitigation Strategies

Upgrade datamodel-code-generator to version 0.61.0 or higher to enforce private network validation by default.
Disable remote references globally using the CLI flag --no-allow-remote-refs or programmatic parameter allow_remote_refs=False.
Apply network-level egress filtering policies to isolate build pipelines and parser hosts from local network services and cloud metadata endpoints.

Remediation Steps:

Identify all internal systems and software dependencies using datamodel-code-generator.
Update requirements.txt, poetry.lock, or Pipfile configurations to use datamodel-code-generator>=0.61.0.
Verify that existing programmatic calls do not set allow_private_network=True unless parsing trusted internal schemas.
Deploy container and egress network policies to block traffic to private subnets (RFC 1918) and loopbacks (127.0.0.0/8) from parser runtimes.