Is there a patch available for CVE-2026-59101?

Yes, a patch is available for CVE-2026-59101. Update the affected software to the latest version immediately.

AutoBangumi CVE-2026-59101

Q: What is the CVSS score of CVE-2026-59101?

CVE-2026-59101 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41432 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-02 VulnCheck

GHSA-p8rr-9cvg-cx5j

SSRF Auto Bangumi

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Unauthenticated network endpoint with no complexity; SSRF leaks only internal reachability via error messages, yielding C:L with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:39 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

5.8 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

AnalysisAI

Server-side request forgery in AutoBangumi before 3.2.8 allows unauthenticated remote attackers to probe internal network services by submitting arbitrary host values to the unprotected POST /api/v1/setup/test-downloader endpoint during the application's initial setup window. The server issues outbound HTTP GET requests to attacker-controlled targets - including internal or reserved IP ranges - and leaks reachability data through echoed connection-error responses, enabling internal network mapping. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 base score is 6.9 (Medium), reflecting unauthenticated network access with limited confidentiality impact.

Technical ContextAI

AutoBangumi (CPE: cpe:2.3:a:estrellaxd:auto_bangumi:*:*:*:*:*:*:*:*) is an open-source anime downloading automation tool by EstrellaXD. The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the application's setup API endpoint - designed to verify downloader connectivity during initial configuration - accepts an arbitrary host parameter with no authentication check and no allowlist validation. The server then issues an outbound HTTP GET to whatever host is supplied, including RFC-1918 private ranges (10.x, 172.16.x, 192.168.x), loopback (127.x), and link-local (169.254.x) addresses. Because the endpoint echoes back connection-error messages, the attacker receives a side-channel signal revealing whether an internal host and port accepted, refused, or timed out the connection - a classic SSRF oracle. The attack surface is scoped to the initial setup window before configuration is finalized.

RemediationAI

The primary fix is to upgrade AutoBangumi to version 3.2.8, which addresses the vulnerability via commit 487bdfec545e805ae416e6ddf28651bd274d6a73 (https://github.com/EstrellaXD/Auto_Bangumi/commit/487bdfec545e805ae416e6ddf28651bd274d6a73). The GitHub release page at https://github.com/EstrellaXD/Auto_Bangumi/releases/tag/3.2.8 should be consulted for upgrade instructions. If an immediate upgrade is not possible, the highest-priority compensating control is to restrict network access to the AutoBangumi setup endpoint - specifically the POST /api/v1/setup/test-downloader route - via firewall rules or reverse-proxy ACLs so only trusted administrative hosts can reach it during setup. Additionally, operators should complete the initial setup as quickly as possible to close the setup-window exposure. Blocking outbound HTTP from the AutoBangumi server process to RFC-1918 and link-local ranges (e.g., via egress firewall rules or network namespace controls) would also limit the attacker's ability to probe internal services, though this may break legitimate downloader connectivity testing. The vendor advisory is the GitHub release and VulnCheck advisory at https://www.vulncheck.com/advisories/autobangumi-ssrf-via-api-v1-setup-test-downloader.