EUVD-2026-26383Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
AnalysisAI
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/-/install-from-uri endpoint enables authenticated attackers to scan internal resources and potentially access sensitive information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity over the network, exposing internal network topology and services to enumeration attacks.
Technical ContextAI
Halo's plugin installation endpoint fails to properly validate or sanitize the URI parameter in the /plugins/-/install-from-uri GET request handler. This is a classic SSRF vulnerability (CWE-918) where user-controlled input is passed to backend HTTP client operations without adequate allowlist controls. The vulnerability allows attackers to redirect the server's HTTP client to internal IP ranges, private cloud metadata services, or localhost endpoints, effectively using the Halo server as a proxy to probe and enumerate internal resources that would otherwise be inaccessible from the attacker's perspective.
RemediationAI
Apply a patched version of Halo newer than v2.22.14 if available from the vendor (https://github.com/halo-dev/halo). The primary fix is to implement strict URI validation in the /plugins/-/install-from-uri endpoint, including: (1) maintaining an allowlist of permitted URI schemes (http/https only) and blocking file://, gopher://, data:// schemes; (2) resolving domain names and rejecting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, ::1/128) before the HTTP request is issued; (3) enforcing connection timeouts and response size limits to prevent exfiltration and DoS amplification. Pending patch availability, restrict access to the /plugins/-/install-from-uri endpoint via network firewall rules to only trusted administrator IPs, or disable the plugin installation feature entirely if not required in production. Implement request rate limiting and audit logging on this endpoint to detect reconnaissance attempts.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today