EUVD-2026-55240
GHSA-8vfr-hg2j-ch26
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable endpoint, low-privilege auth required, no user interaction, scope changes to internal systems with high confidentiality loss; no integrity or availability impact described.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action. The packages/backend/src/apps/http-request/actions/custom-request/index.js handler passes the user-supplied URL directly to the HTTP client with no SSRF controls, enabling access to internal services and metadata endpoints.
AnalysisAI
Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated user holding the 'manage Flow' permission. The HTTP Request app's Custom Request action passes caller-supplied URLs directly to the backend HTTP client with no allowlist, blocklist, or redirect controls, enabling full response-body retrieval from cloud metadata endpoints, internal APIs, and private network hosts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with a user account that holds the 'manage Flow' permission within the Automatisch application; CVSS PR:L confirms a low-privilege authenticated account suffices, not an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score is well-calibrated for this vulnerability: AV:N confirms exploitation is fully remote, AC:L and UI:N mean no preconditions or victim interaction are needed beyond possessing the 'manage Flow' role, and S:C/C:H reflects the high-value data accessible via server-side pivoting to internal infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Automatisch account granted the 'manage Flow' permission creates a new flow using the HTTP Request app's Custom Request action and sets the URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 metadata endpoint). The Automatisch backend fetches the URL server-side and returns the full response body - including temporary AWS IAM credentials - to the attacker's browser, enabling lateral movement into cloud infrastructure without any additional exploitation. … |
| Remediation | No vendor-released patched version has been identified in the referenced sources; the upstream fix commit (if any) beyond 41f3c56 is not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users with 'manage Flow' permission in Automatisch and review HTTP Request app usage logs for suspicious internal or metadata-endpoint URLs; if possible, disable custom URL entry in the HTTP Request action or restrict to a strict external-domain allowlist. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Automatisch
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today