DbGate EUVD-2026-22085

The attacker must hold at minimum low-privilege authenticated credentials on the target DbGate instance (confirmed by CVSS 4.0 PR:L). The DbGate REST/GraphQL interface must be network-reachable from the attacker's position (AV:N). No additional special configuration is required beyond a standard DbGate 7.1.0-7.1.4 deployment with the REST/GraphQL component active, which appears to be a default capability. Exploitation is limited by: the requirement for authenticated DbGate credentials (PR:L eliminates unauthenticated exploitation), the non-automatable nature of the attack (SSVC Automatable=no, meaning mass-scanning exploitation is not practical), and the low impact ceiling (VC:L/VI:L/VA:L - full data exfiltration or RCE is not achievable through this vector alone). The greatest risk applies to multi-tenant or shared DbGate deployments where untrusted users hold accounts.

The aggregate signal across all available sources points to a low-priority, limited-blast-radius vulnerability despite the availability of exploit code. The CVSS 4.0 score of 2.1 with VC:L/VI:L/VA:L confirms bounded impact - the SSRF does not yield remote code execution or full data exfiltration. PR:L in the CVSS 4.0 vector constrains exploitation to authenticated DbGate users, significantly narrowing the attacker surface. EPSS at 0.03% (9th percentile) reflects near-zero probability of active exploitation in the broader ecosystem. SSVC corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial. The E:P supplemental tag confirms public exploit code exists, which marginally elevates risk for environments with untrusted authenticated users. CISA KEV absence confirms no confirmed active exploitation at time of analysis. The primary real-world risk vector is an insider or compromised DbGate account using the SSRF to probe internal network topology or harvest cloud credentials from metadata services - a meaningful but targeted concern rather than a mass-exploitation scenario.

An authenticated DbGate user crafts an API request that supplies a malicious URL (e.g., http://169.254.169.254/latest/meta-data/) as the apiServerUrl1 parameter in the REST/GraphQL component's OpenAPI driver. The DbGate server, without validating the destination, fetches the attacker-specified URL and may return cloud instance metadata - including IAM credentials - to the attacker. A public proof-of-concept is available, reducing the technical skill required for exploitation.