What is the CVSS score of CVE-2026-36757?

CVE-2026-36757 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Halo v2.22.14 CVE-2026-36757

EUVD-2026-26391 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-30 mitre

SSRF N A

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 19:30 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 30, 2026 - 17:00 euvd

EUVD-2026-26391

Analysis Generated

Apr 30, 2026 - 17:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

MEDIUM 4.3

DescriptionCVE.org

A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

AnalysisAI

Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/{name}/upgrade-from-uri endpoint permits authenticated attackers to scan internal network resources and retrieve sensitive data via crafted GET requests, potentially enabling reconnaissance of internal infrastructure. The vulnerability requires valid authentication credentials but operates with low attack complexity, affecting the confidentiality of internal resources without requiring user interaction or administrative privileges.

Technical ContextAI

The vulnerability exists in Halo's plugin upgrade functionality, specifically in the /plugins/{name}/upgrade-from-uri endpoint which is designed to fetch plugin upgrades from remote URIs. The endpoint fails to properly validate or restrict the destination URLs that authenticated users can specify, allowing an attacker to supply arbitrary URIs pointing to internal resources (RFC 1918 addresses, localhost, internal hostnames, or cloud metadata services). The root cause is CWE-918 (Server-Side Request Forgery), a class of vulnerabilities where server-side code makes HTTP requests to URLs supplied or influenced by user input without proper validation. This allows the attacker-controlled Halo server instance to become a proxy for scanning and interacting with internal resources that would otherwise be inaccessible from the external network.

RemediationAI

The primary remediation is to upgrade Halo to a patched version that implements proper URL validation and whitelisting for the /plugins/{name}/upgrade-from-uri endpoint. However, no specific patched version is provided in the input data; verify the latest stable release from https://github.com/halo-dev/halo for a version posterior to 2.22.14. As an interim compensating control, restrict network access to the /plugins/{name}/upgrade-from-uri endpoint to trusted administrator IP addresses or disable the endpoint entirely if plugin upgrades are not in active use. Additionally, implement egress filtering rules on the Halo server to block outbound connections to internal network ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and to metadata endpoints (169.254.169.254 for cloud environments), preventing the server from reaching internal resources even if the SSRF flaw is exploited. Finally, audit plugin upgrade logs for suspicious URI patterns and implement rate limiting on the endpoint to detect and slow reconnaissance attempts.