Server-Side Request Forgery lets an attacker make a server send requests on their behalf, often to internal systems. The 2021 OWASP Top Ten gave it its own category; the 2025 edition merged it into Broken Access Control. I wanted to know whether the record supports reading that as a sign SSRF matters less.
The record points the other way. SSRF's share of published vulnerabilities was roughly flat from 2021 to 2024, then rose to about 12 per 1,000 records in 2025 and about 25 per 1,000 in 2026 so far, with GitHub's advisory database agreeing. The US government's list of exploited vulnerabilities added more SSRF flaws in 2026 than in any earlier year. SSRF was a step in break-ins at Ivanti, Oracle and SonicWall systems between 2024 and 2026, some linked to ransomware, and in the two best-documented cases it gave access to internal services on the device itself rather than to cloud metadata, which is worth noting because the cloud-metadata story is the one everybody tells.
OWASP's own position is more defensible than the merge looks. It described the change as a consolidation, and back in 2021 it had already said small categories added because of its practitioner survey might later be folded into larger ones. It never said SSRF had become less common or less harmful, and it has published no 2025 figures for SSRF alone. In the two best-documented break-ins, SSRF did work like a way past an access check, so the placement fits. AWS, Google, Microsoft and Oracle have also hardened the metadata services these attacks target, though not always by default, and only about half of AWS instances in one large sample enforce the AWS protection.
So the merge is reasonable and the inference people draw from it isn't. What doesn't fit is the new category's text, which carries none of the SSRF-specific advice the 2021 category gave. Applied strictly on its own, the test I set at the start would have returned not supported; I weighed the evidence instead, and I'd rather show that disagreement than hide it.