What is the CVSS score of CVE-2026-30404?

CVE-2026-30404 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-30404?

Within 7 days: Identify all affected systems running wgcloud and apply vendor patches promptly. Implement egress filtering and URL validation for server-side requests.

CVE-2026-30404

EUVD-2026-13120 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-19 mitre

SSRF

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 16:00 euvd

EUVD-2026-13120

Analysis Generated

Mar 19, 2026 - 16:00 vuln.today

CVE Published

Mar 19, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations.

AnalysisAI

Wgcloud v3.6.3's database connection test feature contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal networks and retrieve malicious files. An attacker can exploit this high-severity flaw to conduct reconnaissance on network infrastructure and facilitate further compromise, though no patch is currently available.

Technical ContextAI

Server-Side Request Forgery allows an attacker to induce the server to make HTTP requests to arbitrary destinations, including internal services.

RemediationAI

Validate and whitelist allowed URLs and IP ranges. Block requests to internal/private IP ranges. Use network segmentation to limit server-side request scope.