PullMD CVE-2026-76795

No authentication is required - the CVSS 4.0 vector confirms PR:N and UI:N, meaning any network-accessible instance of PullMD 3.2.0 is exploitable without credentials or user interaction. The sole condition is that the /api endpoint is reachable from the attacker's network, which is the typical self-hosted deployment mode. Exploitation is most impactful when the host runs in a cloud environment with access to an instance metadata service (169.254.169.254 for AWS/GCP/Azure, 100.100.100.200 for Alibaba), but internal network reconnaissance is possible even in on-premises deployments. The vulnerability is not configuration-dependent - no special feature flag or non-default setting is required to be exploitable. Limiting factors include: deployments behind a network firewall that blocks external access to /api reduce remote exploitability; IMDSv2-only cloud instances require a session token that SSRF cannot trivially obtain; and post-patch deployments with an outbound proxy performing egress filtering reduce but do not fully eliminate risk due to the DNS-rebinding residual.

The CVSS 4.0 base score of 5.5 with E:P (proof-of-concept) reflects a moderate-severity finding with network-accessible, unauthenticated exploitation and low impact across confidentiality, integrity, and availability. There is no EPSS score provided in the input and no KEV listing, indicating no confirmed mass exploitation at the time of analysis. Despite the moderate numeric score, the practical risk for cloud-hosted instances is elevated: successful SSRF against the IMDSv1 metadata endpoint (169.254.169.254) can yield IAM credentials, enabling privilege escalation well beyond the CVSS impact ratings imply. The absence of IMDSv2 enforcement at the application layer means many real deployments are fully exposed. For on-premises self-hosted instances without cloud metadata services, risk is limited to internal network reconnaissance and port scanning via the server. The residual DNS-rebinding gap noted in the v3.3.0 changelog means even patched deployments are not fully hardened without an additional outbound proxy layer performing independent egress filtering.

An unauthenticated attacker sends a crafted HTTP GET request to the publicly exposed PullMD /api endpoint with url=http://169.254.169.254/latest/meta-data/iam/security-credentials/; the server resolves the hostname and fetches the cloud metadata service, returning temporary IAM credentials in the response body. A public exploit demonstrating this technique was disclosed via GitHub issue #41 at https://github.com/AeternaLabsHQ/pullmd/issues/41.