What is the CVSS score of CVE-2026-72552?

CVE-2026-72552 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Dub are affected by CVE-2026-72552?

Dub's metatags edge endpoint contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to access internal networks and cloud credential services.

How to fix or mitigate CVE-2026-72552?

Within 24 hours, conduct an inventory of all Dub deployments through version 2026-07-10, assess network exposure of the metatags endpoint, and deploy Web Application Firewall rules to block requests with caller-supplied URLs. Within 7 days, implement network-level denial of outbound traffic from affected systems to 169.254.169.254 (AWS metadata service) and RFC 1918 address space, enable comprehensive logging and alerting for metatags endpoint activity, and notify dependent applications. Within 30 days, apply a vendor patch when released by Dub or migrate to an alternative solution; maintain network restrictions and WAF rules as compensating controls until patched.

Dub CVE-2026-72552

EUVD-2026-56022 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-11 TuranSec

GHSA-gvqm-vjxp-3r33

SSRF Dub

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Publicly accessible unauthenticated endpoint with no user interaction; confidentiality-only impact as SSRF enables arbitrary HTTP fetching and data reading but not writes or service disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:11 vuln.today

CVE Published

Aug 11, 2026 - 11:10 cve.org

HIGH 7.5

DescriptionCVE.org

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.

AnalysisAI

Server-side request forgery in Dub's metatags edge endpoint allows unauthenticated remote attackers to direct the server to issue HTTP requests to arbitrary internal or external hosts. All Dub versions through 2026-07-10 are affected, with the root cause being the endpoint's acceptance of caller-supplied URLs without any denylist filtering or authentication requirement. Attackers can leverage this to probe RFC 1918 address space, enumerate internal services, or exfiltrate credentials from cloud metadata endpoints such as AWS IMDSv1; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Dub is an open-source link management and URL shortening platform (CPE: cpe:2.3:a:dub:dub:*:*:*:*:*:*:*:*) that exposes a metatags edge endpoint designed to fetch Open Graph and other preview metadata from user-supplied URLs. The vulnerability is classified under CWE-918 (Server-Side Request Forgery), a root cause class in which server-side components blindly resolve user-controlled URLs without validating destination addresses against a denylist or allowlist. Because the endpoint is deployed as a publicly accessible edge function and requires no authentication, any internet-reachable Dub instance exposes its full network reachability - including cloud instance metadata services, internal APIs, and RFC 1918 hosts - to unauthenticated callers. The ENISA EUVD entry EUVD-2026-56022 corroborates the affected version boundary reported by TuranSec.

RemediationAI

No specific patched version has been confirmed in the available data - the only reference provided is the upstream GitHub repository at https://github.com/dubinc/dub, where operators should monitor for a fix commit or tagged release addressing this SSRF before upgrading. As immediate compensating controls: restrict or disable the metatags edge endpoint if link preview functionality is not operationally required, as this eliminates the attack surface entirely with no functional trade-off for operators who do not use the feature. If the endpoint must remain available, implement a server-side URL denylist that blocks requests to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), and cloud metadata services (169.254.169.254 for AWS IMDSv1 and fd00:ec2::254 for IPv6); note that denylist approaches are inherently brittle and may be bypassed via DNS rebinding or IPv6 aliases. Adding authentication to the metatags endpoint eliminates unauthenticated exploitation but breaks unauthenticated link preview workflows. For cloud-hosted deployments, enforce IMDSv2 (token-required mode) on all EC2 instances to prevent one-request metadata credential theft even if SSRF is successfully exploited; this is the most impactful single mitigation in AWS environments. Apply network egress filtering at the infrastructure layer to restrict server-side outbound HTTP to approved external destinations.