yudao-cloud CVE-2026-9464

Exploitation requires a valid high-privilege administrator session on the yudao-cloud Admin API (CVSS PR:H confirmed). The attacker must be able to reach the /admin-api/iot/data-sink/create endpoint over the network (AV:N). The IoT module and its data sink HTTP configuration feature must be deployed and accessible in the target instance. No additional complexity or user interaction is required once admin credentials are held (AC:L, AT:N, UI:N). Exploitation is limited by: (1) the mandatory high-privilege authentication prerequisite - unauthenticated attackers cannot exploit this directly; (2) the impact scope being confined to the application server's network perspective, meaning SSRF impact depends heavily on what internal services are reachable from the yudao-cloud host; and (3) the absence of scope change (SC:N/SI:N/SA:N), indicating the vulnerability does not directly compromise resources beyond what the server can already reach.

The real-world risk is low-to-moderate despite public POC availability. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N with E:P yields a score of only 2.0, and the PR:H (high privileges required) component is the dominant limiting factor - exploitation requires a fully authenticated administrator-level session, which substantially shrinks the attacker population. The EPSS score of 0.03% at the 10th percentile corroborates this; the vulnerability has attracted little exploitation interest from the broader threat actor community. The vulnerability is not listed in CISA KEV, confirming no confirmed active exploitation campaign. However, the public POC on GitHub lowers the technical barrier for any attacker who does obtain admin credentials - through phishing, credential stuffing, or insider threat. The CVSS confidentiality/integrity/availability impact is rated Low across all scopes (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N), consistent with the constrained reach of SSRF when not chained with additional vulnerabilities. The vendor was unresponsive, meaning no official guidance or patch exists, which elevates residual risk for unmitigated deployments.

An attacker who has obtained high-privilege administrator credentials - through phishing, credential reuse, or an insider threat - authenticates to the yudao-cloud Admin API and submits a crafted POST request to /admin-api/iot/data-sink/create with a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ or http://internal-service:8080/admin) as the HTTP sink target. The server processes the IotDataSinkHttpConfig and issues an outbound HTTP request to the attacker-controlled destination, potentially returning internal service responses or cloud metadata to the attacker. A public proof-of-concept is available at https://github.com/fakebug111/my_public_bug/blob/main/issus05.md, reducing the technical skill required for an attacker already holding admin credentials.