Kameleo CVE-2026-116280

Exploitation requires authenticated low-privilege access (PR:L) to the Kameleo client-engine application's proxy-validation interface and some passive user interaction (UI:P), after which the attacker manipulates the host/port arguments passed to the InternalController.TestProxy function (file client-engine-application/f.cs) to force server-side requests. It affects Kameleo versions up to and including 5.0.1.26. Limiting factors: the attacker must reach and authenticate to the Kameleo API (which is typically a local client-engine API, so true remote exposure depends on how/where that API is bound), the UI:P interaction requirement, and that the vulnerable route no longer exists in 5.2.0. The exact trigger mechanism beyond manipulation of the host/port argument is not further detailed in the available sources.

This is a moderate, not urgent, issue. The CVSS 4.0 base score of 5.1 reflects a bounded server-side request forgery: the vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N shows network reach and low complexity but requires low-level privileges (PR:L) and passive user interaction (UI:P), with only low impact to the vulnerable system and no subsequent-system (scope) impact. No EPSS score was supplied and the CVE is not on CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as a public PoC reference existing but not verified as working exploit code. The vuln.today decision label is 'this_month' - meaningful but below act_now/emergency. The one tension worth flagging: the function lives in an 'InternalController' (InternalController.TestProxy) and Kameleo exposes a local client-engine API, so the PR:L/AV:N combination assumes an attacker can reach and authenticate to that API - verify the real network exposure of the Kameleo API in your deployment, because if the API is bound only to localhost the practical remote reachability is lower than AV:N alone implies. Overall this is a legitimate but low-to-moderate priority SSRF in a niche product, not a high-CVSS-but-no-real-risk false alarm and not a drop-everything emergency.

An attacker with authenticated access to the Kameleo client-engine API supplies attacker-chosen host and port values to the proxy-validation TestProxy endpoint, causing the Kameleo server-side component to initiate a connection to an internal address of the attacker's choosing (for example internal services or cloud metadata endpoints). A public PoC reference (a Google Drive folder) exists in the advisory, though it is not verified as working exploit code. The CVSS AV:N/AC:L profile makes the request itself easy to craft, but PR:L and UI:P mean low-privilege access and some user interaction are needed.