CVE-2023-42812: Galaxyproject Galaxy

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue.

Affected products

• Galaxyproject Galaxy: before 22.05 (fixed in 22.05)

Published 2023-09-22. Last modified 2026-06-17.