PromptHub CVE-2026-42261

Attacker must possess valid authenticated session credentials for PromptHub (role: user or admin). When the deployment is configured with ALLOW_REGISTRATION=true - a supported and documented configuration option - any internet user can self-register to obtain these credentials, effectively removing authentication as a meaningful barrier. The vulnerability affects the default web application deployment and requires no special product features to be enabled beyond the standard /api/skills/fetch-remote endpoint, which is part of the core skill management functionality. No specific network topology or backend configuration is required on the target server. Exploitation is NOT limited by: user interaction (UI:N in CVSS vector), attack complexity (AC:L indicates straightforward exploitation), or network positioning (AV:N indicates remote exploitation). The server must have outbound network connectivity to internal resources for the SSRF to yield valuable results, but even isolated servers can be used to confirm the vulnerability by attempting to fetch localhost resources.

CVSS 7.1 (High) indicates network-exploitable vulnerability requiring low-privilege authentication (PR:L) with high confidentiality impact and low integrity impact. The attack complexity is low (AC:L) and requires no user interaction (UI:N), making exploitation straightforward for authenticated users. Real-world risk depends heavily on deployment configuration: installations with ALLOW_REGISTRATION=true effectively reduce the authentication barrier to self-registration, expanding the threat actor pool to any internet user. The 5 MB response reflection capability enables substantial data exfiltration from internal endpoints. EPSS data not available in provided intelligence, limiting probabilistic exploitation assessment. No CISA KEV listing and no public exploit code identified at time of analysis, suggesting exploitation has not been widely observed. However, SSRF vulnerabilities are highly valued for cloud environment reconnaissance (AWS/GCP/Azure metadata services) and internal network mapping. The CVSS scope is unchanged (S:U), meaning the vulnerability is confined to the PromptHub application's security context, but the high confidentiality impact (C:H) reflects the ability to read arbitrary internal resources accessible to the server. Priority should be high for internet-facing deployments with open registration; moderate for restricted-access installations with strong authentication controls.

An attacker registers a free account on a PromptHub instance with ALLOW_REGISTRATION=true enabled. After authentication, they send a POST request to /api/skills/fetch-remote with a crafted URL using IPv4-mapped IPv6 notation in hexadecimal form (e.g., http://[::ffff:a9fe:a9fe]/ representing 169.254.169.254). The server-side fetch bypasses the isPrivateIPv6 filter, retrieves AWS EC2 instance metadata containing IAM credentials, and reflects the JSON response (up to 5 MB) back to the attacker. The attacker then uses these credentials to access AWS resources or pivots to internal services at RFC1918 addresses using similar IPv6 encoding techniques. No public exploit code exists, but the attack is trivial to execute with basic HTTP client tools and IPv6 address manipulation knowledge.