Wallos CVE-2026-33401

Authenticated user account required on Wallos versions prior to 4.7.0. Attacker supplies crafted URLs to: AI Ollama host parameter, AI recommendations endpoint, or notification cron job to reach internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure IMDS), or localhost-bound services.

This vulnerability presents a high real-world risk despite the absence of a CVSS vector score. The attack requires authentication (reducing immediate exposure but increasing insider threat potential), and the attack complexity is low—attackers need only supply a crafted URL to trigger requests to arbitrary endpoints. The technical impact is significant: access to cloud metadata services can expose credentials, API tokens, and instance identity documents (particularly dangerous for AWS IMDSv1 which lacks authentication), enabling lateral movement and privilege escalation. The patch is available (version 4.7.0), indicating confirmed exploitation potential and vendor acknowledgment of severity. The lack of CVSS and EPSS scores may reflect the CVE being recently published (2026 date suggests emerging data); however, the existence of three attack vectors and the proof-of-concept commits in the reference material indicate this is an actively developed exploit scenario rather than a theoretical edge case. For self-hosted environments where Wallos has network access to cloud infrastructure or internal services, this is a critical priority.

An authenticated user with legitimate access to Wallos (perhaps a family member with a subscription tracking account) maliciously modifies the AI Ollama host parameter to point to the AWS metadata endpoint (http://169.254.169.254/latest/meta-data/) instead of a local Ollama instance. When the AI recommendations feature triggers or the cron job executes, the application makes an unvalidated request to the metadata endpoint, retrieving the EC2 instance identity credentials. The attacker captures these temporary credentials from application logs or error messages, then uses them to access AWS resources or assume higher-privileged roles within the cloud environment. This scenario is particularly effective because the attacker has legitimate authentication to the application, making the request appear as normal application behavior, and because cloud metadata endpoints are often overlooked in security hardening checklists.