On this page
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Weakness Summary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
- Canonical source: MITRE CWE-441 (opens in a new tab)
- Published Atomicorp CVE observations: 7
- Distinct affected products in those observations: 7
- Active Atomicorp rules associated with this weakness: 16
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2026-83548 | SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution | sma8200v | Protected by Atomicorp rules | 330925 |
| CVE-2026-53513 | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration | better-auth/sso | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73079 | Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstrea | sub2api | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 340790 , 340791 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-61793 | Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter | og-image | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63643 | MagicMirror: ssrf calendar .js | MagicMirror | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330925 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340790 | Active | disruptive (deny) |
| 340791 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 398001 | Active | non-disruptive (pass) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-219 (opens in a new tab) , CAPEC-465 (opens in a new tab)