EUVD-2026-67816
GHSA-qch5-28r4-f5gj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint (AV:N, PR:N) with high confidentiality loss from metadata/internal service exposure and low integrity impact from object storage name control.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
AnalysisAI
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The POST /api/v1/workflow/report/callback endpoint requires no authentication and no special configuration - any network-reachable bisheng instance through version 2.6.0-fix2 running its default backend is exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 accurately reflects the severity: network-accessible (AV:N), low complexity (AC:L), no prerequisites (PR:N, UI:N, AT:N), with high confidentiality impact on the vulnerable system (VC:H) and low integrity impact (VI:L) from object storage name manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version beyond 2.6.0-fix2 has been independently confirmed at time of analysis - monitor https://github.com/dataelement/bisheng and https://github.com/dataelement/bisheng/issues/2190 for an updated release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all bisheng deployments and implement network egress rules blocking cloud metadata endpoints (169.254.169.254 for AWS, 169.254.169.255 for Azure) and private IP ranges from bisheng instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today