EUVD-2026-26383Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
AnalysisAI
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/-/install-from-uri endpoint enables authenticated attackers to scan internal resources and potentially access sensitive information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity over the network, exposing internal network topology and services to enumeration attacks.
Technical ContextAI
Halo's plugin installation endpoint fails to properly validate or sanitize the URI parameter in the /plugins/-/install-from-uri GET request handler. This is a classic SSRF vulnerability (CWE-918) where user-controlled input is passed to backend HTTP client operations without adequate allowlist controls. The vulnerability allows attackers to redirect the server's HTTP client to internal IP ranges, private cloud metadata services, or localhost endpoints, effectively using the Halo server as a proxy to probe and enumerate internal resources that would otherwise be inaccessible from the attacker's perspective.
RemediationAI
Apply a patched version of Halo newer than v2.22.14 if available from the vendor (https://github.com/halo-dev/halo). The primary fix is to implement strict URI validation in the /plugins/-/install-from-uri endpoint, including: (1) maintaining an allowlist of permitted URI schemes (http/https only) and blocking file://, gopher://, data:// schemes; (2) resolving domain names and rejecting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, ::1/128) before the HTTP request is issued; (3) enforcing connection timeouts and response size limits to prevent exfiltration and DoS amplification. Pending patch availability, restrict access to the /plugins/-/install-from-uri endpoint via network firewall rules to only trusted administrator IPs, or disable the plugin installation feature entirely if not required in production. Implement request rate limiting and audit logging on this endpoint to detect reconnaissance attempts.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today