JobOps EUVD-2026-102477

Exploitation requires reaching the POST /api/manual-jobs/fetch handler and supplying an attacker-controlled value in the url field. In a standard deployment the attacker must hold valid authenticated access (PR:L); however, the description explicitly states that when the instance is running in demo mode, unauthenticated clients can trigger the same request - demo mode is the key configuration that removes the authentication barrier. The server must have network reachability to the targeted internal destination (loopback, private ranges, or a cloud metadata service such as 169.254.169.254) for metadata/internal-data disclosure to succeed; impact is limited to confidentiality (page content returned to the caller) with no integrity or availability effect, and no user interaction is needed.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H with VI/VA:N) describes a network-reachable, low-complexity, authenticated information-disclosure flaw with no integrity or availability impact and no scope change - matching a classic SSRF used to read cloud metadata and internal service responses. No EPSS score, CISA KEV listing, or POC/exploit-code flag was supplied in the input, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The one meaningful risk amplifier is the description's note that exploitation is possible by unauthenticated clients when the instance runs in demo mode, which effectively lowers the PR:L barrier in that specific deployment - a condition the base CVSS vector (PR:L) does not capture. A detailed third-party technical write-up (hackmd) and a direct source-code reference to the vulnerable handler exist, which lowers the barrier to developing an exploit even though no packaged POC is indicated. Net: a genuine, verifiable SSRF worth patching, but given an obscure product and no exploitation/EPSS signals, it is a moderate-priority issue rather than an emergency.

An authenticated user (or any client if the instance is running in demo mode) sends a POST to /api/manual-jobs/fetch with the url field pointing at a loopback, private-range, or cloud metadata endpoint (e.g. 169.254.169.254). The server dereferences the URL and returns the fetched page content to the attacker, disclosing instance metadata, cloud credentials, or internal service data. No packaged public exploit is indicated, but a public technical write-up and the vulnerable source line are referenced, making exploitation straightforward.