Coze Studio CVE-2026-92795

Requires an authenticated Coze Studio account (PR:L) with the ability to register or configure plugin tools; the flaw is that the plugin-tool registration does not validate or restrict the supplied server URL, so the backend will issue HTTP requests to arbitrary attacker-chosen destinations. Exploitation is limited to versions through 0.5.1 and to deployments where the backend network can reach valuable targets - practical impact is highest when the instance runs in a cloud environment with an accessible metadata service (e.g. 169.254.169.254) or has internal-only services reachable from the backend. Impact is read/confidentiality only; no user interaction is needed beyond the attacker's own authenticated actions.

This is a moderate-priority, credentialed SSRF rather than a critical remote-takeover flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, 7.1) shows network reachability with low complexity but requires authentication (PR:L) and yields confidentiality impact only - no integrity or availability effect, and no CVSS scope/subsequent-system change (SC:N). No EPSS score, no CISA KEV listing, and no public exploit code are provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The real risk driver is the impact target: SSRF that can reach cloud metadata endpoints (e.g. IMDS) can expose cloud IAM credentials, which materially raises the practical severity above a generic internal-scan SSRF even though the base metrics stay confidentiality-only. The PR:L requirement (a valid Coze Studio account) is the primary limiting factor and keeps this from being a mass-exploitation candidate. No conflicting signals: the CVSS vector, the CWE-918 classification, and the description are consistent. Net: a genuine issue worth prompt patching for internet- or multi-tenant-exposed deployments, but not an emergency-level widespread threat absent exploitation evidence.

An authenticated Coze Studio user registers a plugin tool and supplies an attacker-chosen server URL (e.g. http://169.254.169.254/latest/meta-data/ or an internal-only service). When the backend invokes the plugin over HTTP, it fetches the attacker-specified endpoint and returns the response body, letting the attacker read cloud instance metadata or internal service data reachable only from the backend network. No public exploit code is identified, but the vulnerable code path (invocation_http.go L127-146) is publicly referenced.