Label Studio CVE-2026-85179

Exploitation requires a valid authenticated session in Label Studio with sufficient permissions to create or modify webhooks - typically available to any user role that can manage projects. The attacker must also enable the 'Send payload' option on the webhook to exfiltrate annotation data in outbound requests; SSRF probing of internal services is possible regardless of this setting. Cloud metadata exfiltration (the highest-impact scenario) is conditional on the Label Studio server running in a cloud environment where the metadata endpoint 169.254.169.254 is reachable from the application process - standard for AWS EC2, GCP Compute, and Azure VM deployments without explicit IMDSv2 enforcement or metadata endpoint blocking. The SSRF_PROTECTION_ENABLED setting was present in the codebase prior to the fix but was not applied to webhook URL validation, meaning instances with this setting enabled for other features were still vulnerable via webhooks.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N, score 8.4) correctly identifies the key risk factors: low-privilege authenticated access is sufficient, no complexity or attack requirements apply, and the subsequent-system confidentiality is rated High - reflecting the ability to reach cloud metadata services or internal APIs that may expose IAM credentials or sensitive service data. The PR:L constraint is the principal limiting factor: an attacker must hold a valid Label Studio account. In shared annotation platforms (common in enterprise ML teams with many annotators), low-privilege accounts are frequently distributed broadly, reducing this barrier in practice. EPSS data is not provided, and this is not in CISA KEV, so exploitation probability cannot be quantified. No public PoC is identified at time of analysis. The risk is elevated in cloud-hosted or Kubernetes-deployed instances where the instance metadata service is reachable at 169.254.169.254 - successful exploitation there can yield cloud provider IAM credentials, substantially escalating impact beyond the CVSS score suggests.

An annotator or low-privilege user authenticated to a cloud-hosted Label Studio instance creates a webhook pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ with payload transmission enabled. When the next annotation event fires, Label Studio's webhook dispatch issues an HTTP GET to the EC2 instance metadata service, and the IAM role credentials in the response body are transmitted as part of the webhook payload to an attacker-controlled logging endpoint - yielding temporary cloud credentials without any network proximity requirement. No public PoC code is required; the attack is achievable with only the webhook API and a valid session token.