# Security: Upcoming Security Release for openedx-platform 2026-03-27

**URL:** <https://discuss.openedx.org/t/security-upcoming-security-release-for-openedx-platform-2026-03-27/18655>\
**Category:** Security\
**Created:** [March 25, 2026, 12:46pm UTC](https://discuss.openedx.org/t/security-upcoming-security-release-for-openedx-platform-2026-03-27/18655 "2026-03-25T12:46:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![feanil](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/feanil/32/37_2.png) [@feanil](https://discuss.openedx.org/u/feanil)\
**Post date:** [March 25, 2026, 12:46pm UTC](https://discuss.openedx.org/t/security-upcoming-security-release-for-openedx-platform-2026-03-27/18655/1 "2026-03-25T12:46:11Z")

</div>

A security patch for **openedx/edx-platform** will be added to the **Ulmo** release and to the current github master branch around 2026-03-27T14:00:00Z.

It will fix one security defect with a “moderate” [CVSS 3.1 severity rating](https://nvd.nist.gov/vuln-metrics/cvss).

Details will be published here after release: [GitHub security advisory](https://github.com/openedx/openedx-platform/security/advisories/GHSA-m6rg-rp98-4crw)

---

<div class="post-metadata">

**Author:** ![feanil](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/feanil/32/37_2.png) [@feanil](https://discuss.openedx.org/u/feanil)\
**Post date:** [March 25, 2026, 3:05pm UTC](https://discuss.openedx.org/t/security-upcoming-security-release-for-openedx-platform-2026-03-27/18655/2 "2026-03-25T15:05:49Z")

</div>

Correction, not patching Palm but Ulmo, the current supported release.

---

<div class="post-metadata">

**Author:** ![feanil](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/feanil/32/37_2.png) [@feanil](https://discuss.openedx.org/u/feanil)\
**Post date:** [March 30, 2026, 3:26pm UTC](https://discuss.openedx.org/t/security-upcoming-security-release-for-openedx-platform-2026-03-27/18655/3 "2026-03-30T15:26:01Z")

</div>

The disclosure is now public and both master and ulmo have been patched.
