EUVD-2026-25657Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in IhateCreatingUserNames2 AiraHub2 up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. Affected is the function connect_stream_endpoint/sync_agents of the file AiraHub.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery (SSRF) in AiraHub2 allows authenticated remote attackers to manipulate the connect_stream_endpoint and sync_agents functions in AiraHub.py, enabling arbitrary HTTP requests to internal or external systems. The vulnerability affects multiple endpoints and has publicly available exploit code; however, the vendor has not responded to disclosure attempts and uses a rolling release model, making patch status unclear.
Technical ContextAI
AiraHub2 is affected in the Endpoint component, specifically in the connect_stream_endpoint and sync_agents functions within AiraHub.py. The vulnerability stems from insufficient input validation or request sanitization when constructing HTTP requests (CWE-918: Server-Side Request Forgery). The rolling release model means the product does not maintain traditional versioning; affected instances are identified by commit hash (up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e) rather than semantic versions. The SSRF vulnerability allows authenticated users to forge requests that originate from the server, potentially bypassing network segmentation, accessing internal services, or exfiltrating sensitive data from backend systems.
RemediationAI
Because the vendor has not provided a patched release and AiraHub2 uses a rolling commit-based release model rather than semantic versioning, patching requires pulling from the source repository (likely GitHub) and verifying that the deployed commit is newer than the vulnerable 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. Organizations should: (1) Check the deployed commit hash of AiraHub2 and compare it to the vulnerable commit; (2) If vulnerable, pull the latest commits from the official repository and re-deploy; (3) Review the commit log between the vulnerable commit and current HEAD for security fixes. Workarounds pending a patch: Restrict access to the sync_agents and connect_stream_endpoint functions to trusted internal users only (limit PR:L scope by tightening authentication and authorization policies). Implement egress filtering on the AiraHub2 instance to prevent outbound connections to sensitive internal systems or to restrict HTTP requests to a whitelist of approved endpoints. Monitor HTTP requests originating from AiraHub2 for anomalous patterns (e.g., requests to internal IP ranges, unusual ports, or sensitive internal services). These controls reduce exploitability but do not eliminate the vulnerability; source code patching is the definitive fix.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today