Nucleoid CVE-2025-11864

Exploitation requires that the Nucleoid instance actually exercise the Outbound Request Handler code path (extension.apply in /src/cluster.ts) with the https/ip/port/path/headers arguments influenced by remote input - i.e., an application or declarative logic on top of Nucleoid that passes externally supplied values into an outbound request. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication or user interaction is needed and complexity is low. Real-world impact is limited by what the Nucleoid host can reach: SSRF value depends on the presence of sensitive internal services, cloud metadata endpoints, or non-segmented internal networks reachable from the server; the uniformly LOW impact metrics (VC:L/VI:L/VA:L) suggest constrained read/influence rather than full internal compromise. A limiting factor is deployment scale - Nucleoid is a niche runtime, so exposed, internet-reachable instances exercising this path may be uncommon.

This is a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SSRF, but the impact metrics are uniformly LOW (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N), yielding a medium score of 6.9. Exploitation signals are weak-to-moderate: EPSS is 0.46% (38th percentile), indicating low modeled probability of exploitation in the near term; there is no CISA KEV listing and no SSVC exploitation/automatable data supplied. No vendor security advisory is present - the only sources are a third-party researcher's GitHub discovery writeup and VulDB catalog entries (reporter cna@vuldb.com), so the CVSS was assigned by VulDB rather than the vendor. The signals are internally consistent (low EPSS, no KEV, low impact), so this reads as a genuine-but-low-stakes issue rather than a high-CVSS/low-real-risk mismatch; the main caveat is that SSRF severity is highly deployment-dependent and could be worse in environments with sensitive internal services or cloud metadata endpoints reachable from the Nucleoid host.

A remote, unauthenticated attacker submits a request to a Nucleoid instance whose declarative logic invokes the Outbound Request Handler (extension.apply in /src/cluster.ts), supplying attacker-chosen https/ip/port/path/headers values so the server issues an HTTP request to an internal target the attacker cannot reach directly. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed; the attacker could probe internal services or attempt to read cloud metadata. A researcher's discovery writeup is published on GitHub and may include reproduction details, but no confirmed weaponized public exploit was provided in the input data.