Summarize EUVD-2026-36308

The attacker must control a podcast RSS feed that contains a crafted podcast:transcript element with a malicious URL value. The target host must use Summarize to process that specific feed - passive user interaction is required (UI:P per CVSS 4.0). No authentication on Summarize itself is required (PR:N), but the attacker cannot directly trigger processing; they must induce a user or automated job to consume their feed. Exploitation is limited by: (1) the attacker's ability to get their feed processed by the target - either by hosting a new feed or compromising an existing one the target already subscribes to; (2) what internal services are reachable from the host running Summarize; and (3) DNS rebinding effectiveness, which depends on TTL expiry timing and resolver caching behavior. The non-default condition is that the host must be running Summarize in an environment with network access to sensitive internal services AND must process untrusted or externally-controlled podcast feeds.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N) reflects a nuanced risk profile: while the attack is network-reachable with no privilege requirement on Summarize itself and low complexity, passive user interaction is required (UI:P - a user must trigger processing of the malicious podcast feed). The SC:H metric captures the real consequence: high confidentiality impact on subsequent systems (internal network services whose responses are exfiltrated through the summarization flow), not on the Summarize host itself. There is no confirmed CISA KEV entry and no publicly identified exploit code, which aligns with the VulnCheck-reported, research-discovery posture. EPSS data was not provided in the intelligence package, so exploitation probability cannot be quantified beyond the structural analysis. Real-world risk is significant for deployments that process untrusted or community-sourced podcast feeds in environments where Summarize has network adjacency to internal services (e.g., home-lab servers, enterprise internal tools, self-hosted infrastructure). The DNS rebinding and redirect bypass mechanisms meaningfully lower the bar past what a naive SSRF assessment would suggest, but the UI:P requirement and the need for the attacker to control a feed that the target actually processes represent genuine limiting factors.

An attacker publishes or compromises a podcast RSS feed and inserts a malicious podcast:transcript URL pointing to an internal service - for example, a metadata endpoint at an internal IP or a DNS name that rebinds to 169.254.169.254 (cloud instance metadata). When a user or automated pipeline runs Summarize against that feed, the application fetches the transcript URL, retrieves the internal service response, and surfaces it through the summarization output, leaking sensitive internal data to the attacker. No public exploit code has been identified, but the attack requires only a controlled RSS feed and a target that processes it.