What is the CVSS score of CVE-2026-30118?

CVE-2026-30118 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Scalar Astro are affected by CVE-2026-30118?

scalar/astro v0.1.13 contains a critical server-side request forgery vulnerability that allows unauthenticated attackers to expose authentication credentials and headers through the Scalar Proxy…

How to fix or mitigate CVE-2026-30118?

24 hours: Inventory all systems running scalar/astro v0.1.13; immediately restrict network access to the Scalar Proxy endpoint or isolate affected deployments from production networks. 7 days: Implement network segmentation and Web Application Firewall rules to block/validate the scalar_url parameter; evaluate migration options to alternative products or patched versions; rotate all potentially exposed credentials. 30 days: Complete migration off v0.1.13 or validate full remediation with network controls; conduct comprehensive audit of accessed resources during exposure window.

Scalar Astro CVE-2026-30118

EUVD-2026-30948 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-19 mitre

GHSA-46mr-vgx5-fc36

Privilege Escalation SSRF N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 14:22 vuln.today

CVSS changed

May 20, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

May 19, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows unauthenticated attackers to force the backend server to send HTTP requests to attacker-controlled URLs, leading to authentication cookies and headers exposure and possible privilege escalation.

AnalysisAI

Server-side request forgery in scalar/astro v0.1.13 allows remote unauthenticated attackers to coerce the backend into making HTTP requests to attacker-controlled destinations via the scalar_url query parameter of the Scalar Proxy endpoint. Exploitation can expose authentication cookies and headers forwarded by the proxy, enabling account takeover and potential privilege escalation. Publicly available exploit code exists, though EPSS is low (0.03%) suggesting limited mass exploitation at this time.

Technical ContextAI

Scalar is an open-source API documentation and reference platform; the affected component is the Astro integration (scalar/astro) at version 0.1.13, which ships a proxy endpoint that fetches arbitrary URLs supplied through the scalar_url query parameter. The flaw is a textbook CWE-918 (Server-Side Request Forgery): user input is used to construct an outbound HTTP request from the server without validating the destination host, scheme, or whether internal/loopback/metadata ranges are permitted. Because the proxy forwards request headers, any session cookies or authorization tokens attached to the proxy request can be leaked to the attacker-controlled destination. The CPE in NVD is the placeholder cpe:2.3:a:n/a:n/a, indicating that no canonical vendor/product CPE has yet been assigned for scalar/astro.

RemediationAI

No vendor-released patch identified at time of analysis - neither the NVD nor EUVD record cites a fixed version, and no vendor advisory is linked in the provided references, so administrators should monitor the scalar/astro repository for a release above 0.1.13 and upgrade as soon as one is published. Until a fix is available, restrict or disable the Scalar Proxy endpoint at the reverse proxy or web server (deny requests to the proxy route that handle scalar_url), or strip/validate the scalar_url query parameter with an egress allowlist that constrains it to known documentation hosts only; both of these break the legitimate proxy-driven API try-it functionality, so expect documentation 'Try it' features to fail until restored. As a defense-in-depth control, block outbound traffic from the application host to internal RFC1918 ranges and cloud metadata endpoints (169.254.169.254, fd00:ec2::254) so that even a successful SSRF cannot reach sensitive internal services, and rotate any session cookies or API tokens that may have been forwarded through the proxy. Authoritative tracking URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30118.