Which versions of Apiflow are affected by CVE-2026-4528?

An unauthenticated Server-Side Request Forgery vulnerability in trueleaf ApiFlow 0.9.7 allows attackers to hijack server requests and access internal resources without a patch currently available.

Is there a public PoC exploit available for CVE-2026-4528?

Yes, a public proof-of-concept exploit is available for CVE-2026-4528. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4528?

Within 24 hours: Inventory all systems running trueleaf ApiFlow 0.9.7 and assess their exposure to untrusted networks; immediately implement network segmentation or WAF rules to restrict access to the validateUrlSecurity endpoint. Within 7 days: Deploy compensating controls including URL allowlisting, egress filtering to block internal IP ranges, and enhanced logging on affected systems; evaluate feasibility of upgrading to a patched version or alternative product. Within 30 days: Complete migration away from version 0.9.7 to a patched release or decommission the affected component; conduct a security audit of any internal resources accessed during the vulnerability window.

Apiflow CVE-2026-4528

Q: What is the CVSS score of CVE-2026-4528?

CVE-2026-4528 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14258 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-21 VulDB

GHSA-29mf-95fh-hwxf

SSRF Apiflow

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 22:15 euvd

EUVD-2026-14258

Analysis Generated

Mar 21, 2026 - 22:15 vuln.today

CVE Published

Mar 21, 2026 - 22:02 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http_proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

A Server-Side Request Forgery (SSRF) vulnerability exists in the validateUrlSecurity function within trueleaf ApiFlow version 0.9.7's URL validation handler. This flaw allows unauthenticated remote attackers to manipulate server-side requests to access internal resources or perform actions on behalf of the server. A public proof-of-concept exploit has been disclosed and is available, significantly lowering the barrier to exploitation.

Technical ContextAI

The vulnerability resides in the validateUrlSecurity function located in packages/server/src/service/proxy/http_proxy.service.ts of ApiFlow's URL Validation Handler component. ApiFlow is a trueleaf product identified by CPE cpe:2.3:a:trueleaf:apiflow:*:*:*:*:*:*:*:*. The root cause is classified as CWE-918 (Server-Side Request Forgery), indicating improper validation of user-supplied URLs that are subsequently used in server-initiated HTTP requests. This allows attackers to bypass intended access controls by forcing the application server to make requests to arbitrary internal or external destinations, potentially exposing sensitive internal services, cloud metadata endpoints, or enabling port scanning and further attacks from the server's network context.

RemediationAI

Upgrade ApiFlow immediately to a version newer than 0.9.7 that addresses this SSRF vulnerability, checking with TrueLeaf for the latest patched release. Until patching is feasible, implement network-level controls including strict egress filtering that prevents the ApiFlow server from initiating connections to internal IP ranges (RFC1918 addresses, link-local, loopback), cloud metadata endpoints (169.254.169.254, fd00:ec2::254), and non-essential external destinations. Deploy a Web Application Firewall or reverse proxy with URL validation rules that block requests containing private IP addresses, localhost references, or cloud metadata paths. Review application logs for suspicious URL patterns in proxy requests and consider temporarily disabling the affected URL validation handler functionality if business operations permit. Consult VulDB references at https://vuldb.com/?id.352316 and https://vuldb.com/?ctiid.352316 for additional technical context and the detailed exploit documentation at https://www.notion.so/Server-Side-Request-Forgery-SSRF-in-ApiFlow-329ea92a3c4180489df2fa2702078fe5 to understand attack patterns for detection engineering.