TaskingAI CVE-2026-111321

Requires an authenticated identity - specifically a valid project API key OR a console admin login - plus the ability to create or edit a user-defined action and supply an OpenAPI specification. The attacker must set servers[0].url to an attacker-chosen internal/loopback/cloud-metadata address (the url is not validated per the vulnerable code at openapi_utils.py#L168-169 and openapi_call.py#L144) and then trigger it with POST /actions/{action_id}/run. Limiting factors: exploitation is impossible without prior credentials, the backend must have network routes to the targeted internal/metadata hosts, and the read-back is capped at 64 KiB, so this is primarily a credentialed-insider or stolen-key risk rather than fully unauthenticated remote SSRF.

This is a medium-severity SSRF (CWE-918) that should be treated as a real but bounded issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score agree the flaw is network-reachable and low-complexity but requires privileges (PR:L) - exploitation is gated behind a valid project API key or console admin login, which materially limits the attacker population to insiders or anyone who has already obtained credentials. Impact is explicitly limited (VC:L/VI:L/VA:N, no subsequent-system scope change SC:N), consistent with a read-back SSRF capped at 64 KiB rather than full internal compromise or RCE. No EPSS score, KEV listing, or explicit POC flag was supplied in the input; a detailed third-party technical write-up (hackmd) and a VulnCheck advisory exist with exact vulnerable source lines, which raises the practical ease of reproduction even though no weaponized exploit is confirmed. Net: a credible, easily-reproducible post-authentication SSRF whose real-world priority is moderated by the authentication requirement and the capped, read-oriented impact - prioritize patching in exposed/multi-tenant deployments, lower priority for isolated single-tenant installs.

An authenticated user holding a project API key (or a console admin) defines a custom action whose OpenAPI spec sets servers[0].url to an internal address such as a cloud metadata endpoint (e.g. 169.254.169.254) or a loopback/internal service. They invoke the action via POST /actions/{action_id}/run, causing the TaskingAI backend to issue the request on their behalf and return up to 64 KiB of the response, potentially leaking cloud credentials or internal service data. A public technical write-up documenting the exact vulnerable code paths exists, making reproduction straightforward, though no packaged exploit tool is confirmed in the provided data.