CVE-2026-58301: Apache Shiro: Server-side POST request may be steered to an alternate host

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-01
Weakness: CWE-918

Description

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.

Affected products

Apache Software Foundation Apache Shiro: from 2.0.0 before 3.0.1 — fixed in 3.0.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Shiro 3.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-58301 or the next vulnerability affects your stack