Is there a public PoC exploit available for CVE-2026-9464?

Yes, a public proof-of-concept exploit is available for CVE-2026-9464. Prioritise patching immediately. EPSS: 0.0%.

yudao-cloud CVE-2026-9464

Q: What is the CVSS score of CVE-2026-9464?

CVE-2026-9464 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31684 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-25 VulDB

GHSA-mrqr-qxqw-9753

SSRF Yudao Cloud

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:16 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

4.7 (MEDIUM) 2.0 (LOW)

DescriptionCVE.org

A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in YunaiV yudao-cloud 2026.03 allows authenticated administrators to force the server to issue arbitrary HTTP requests via the IoT data sink creation endpoint. The vulnerability exists in the IotDataSinkHttpConfig function exposed at /admin-api/iot/data-sink/create, where attacker-controlled URL parameters are passed to an outbound HTTP client without adequate validation. A proof-of-concept exploit has been publicly disclosed on GitHub; however, the CVSS 4.0 base score of 2.0 and a 0.03% EPSS probability reflect the significant limiting factor of requiring high-privilege authentication, and no KEV listing indicates no confirmed active exploitation at time of analysis.

Technical ContextAI

yudao-cloud (CPE: cpe:2.3:a:yunaiv:yudao-cloud:*:*:*:*:*:*:*:*) is an open-source microservices cloud platform built on Spring Cloud. The IoT module exposes an admin REST API for configuring data sinks - destinations where IoT device telemetry is forwarded. The vulnerable function, IotDataSinkHttpConfig, processes HTTP-type sink configurations and appears to construct outbound HTTP requests using caller-supplied URL parameters without sufficient allowlist enforcement or protocol restriction. CWE-918 (Server-Side Request Forgery) describes exactly this root cause: untrusted input controlling the target of a server-initiated network request. This can expose internal network services - metadata APIs, internal dashboards, or adjacent microservices - that are not reachable from the external network but are reachable from the application server itself.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor was contacted prior to disclosure and did not respond, leaving the vulnerability unpatched. As a primary compensating control, restrict access to the Admin API layer (/admin-api/*) to trusted internal networks only using a WAF, reverse proxy ACL, or network firewall rule, which would prevent external actors from reaching the vulnerable endpoint even with stolen credentials. Additionally, implement an outbound HTTP allowlist on the application server to restrict the destinations the application server can reach, limiting the utility of any SSRF exploitation to only approved endpoints - note this may require application-level configuration and could impact legitimate IoT data sink functionality. Monitor outbound HTTP requests from the yudao-cloud application server for anomalous destinations such as RFC 1918 addresses, cloud metadata endpoints (169.254.169.254), or localhost. Audit all admin-level accounts and enforce MFA to reduce the risk of credential compromise, which is the prerequisite for exploitation. Track the VulDB entry at https://vuldb.com/vuln/365445 for any future patch release.