EUVD-2026-41426
GHSA-r2cx-cpfx-9h63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to LobeChat with low-privilege account
-
DeliverySubmit internal URL to importFromUrl/fetchImageFromUrl
-
ExploitServer calls global fetch bypassing ssrf-safe-fetch
-
ExecutionReach cloud metadata endpoint (169.254.169.254)
-
PersistServer returns internal response
-
ImpactExfiltrate IAM/cloud credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated LobeChat account (CVSS PR:L) and network reachability to the LobeChat server. The concrete trigger is supplying a user-controlled URL to one of two specific endpoints - the skill import service (importFromUrl) or the topic cover update (fetchImageFromUrl) - both of which use the global fetch rather than ssrf-safe-fetch. High-value exploitation additionally requires that the server can route to an internal target, most notably a cloud instance metadata endpoint (169.254.169.254); this is the practical prerequisite for credential theft. Limiting factors: the attacker must have valid credentials (no anonymous access), the deployment must permit server egress to the intended internal address, and the target must be a version before 2.2.10-canary.18. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:H) scores 8.3 (High) and is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated account), no user interaction, high confidentiality impact on both the vulnerable system and a subsequent system (the internal service whose data is exfiltrated). Both a public POC and a vendor patch exist, materially raising practical risk versus a theoretical finding. It is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active mass exploitation - treat this as a real, prioritizable issue (patch promptly) rather than an emergency zero-day. The principal limiter is the PR:L authentication requirement: an attacker needs a valid LobeChat account, so exposure is highest for internet-facing deployments allowing self-registration or with many low-trust users, and in cloud environments where the metadata endpoint yields IAM credentials. |
| Exploit ScenarioDerived | An attacker registers or uses an existing low-privilege LobeChat account and calls the skill import (importFromUrl) or topic cover update (fetchImageFromUrl) feature, supplying a URL pointing at the cloud metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The server fetches that internal URL with the unprotected global fetch and returns the response, leaking temporary IAM credentials or internal service data to the attacker. A public POC referenced in the upstream issue (github.com/lobehub/lobehub/issues/16536) lowers the skill barrier for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing internal HTTP requests to attacker-chosen URLs, enabling disclosure of internal service responses and cloud credentials from instance metadata endpoints. The flaw stems from two endpoints - skill import (importFromUrl) and topic cover update (fetchImageFromUrl) - calling the global fetch instead of the project's ssrf-safe-fetch wrapper. Publicly available exploit code exists and a vendor patch has shipped, though it is not listed in CISA KEV.
RemediationAI
Upgrade to LobeChat 2.2.10-canary.18 or later, which routes the affected endpoints through the ssrf-safe-fetch wrapper (see fixing PR https://github.com/lobehub/lobehub/pull/16601 and advisory https://www.vulncheck.com/advisories/lobechat-canary-18-ssrf-via-importfromurl-and-fetchimagefromurl). If immediate patching is not possible, apply compensating controls: at the network layer, deny the LobeChat server egress to link-local (169.254.169.254) and RFC1918 internal ranges, or enforce IMDSv2 / disable IMDSv1 on cloud instances so metadata cannot be read via a simple GET - trade-off is that legitimate outbound image/skill fetches to blocked ranges will also fail. Restrict or disable self-registration and limit accounts to trusted users to raise the PR:L bar, and consider disabling or gating the skill import and topic-cover-from-URL features if not required, at the cost of losing that functionality. Note this is an upstream code fix confirmed by a tagged canary release; verify the running version after upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LobeChat is an open-source AI/LLM chat framework (vendor lobehub). The vulnerability is a classic CWE-918 Server-Side Request Forgery: the application maintains an SSRF-protective HTTP client (ssrf-safe-fetch) intended to validate and restrict outbound request destinations, but two features bypass it by invoking the raw global fetch. The skill import service resolves a user-supplied URL (importFromUrl) and the topic cover feature retrieves a user-supplied image URL (fetchImageFromUrl); because neither path routes through the safe wrapper, no allow-listing or blocking of internal/link-local addresses (e.g., 169.254.169.254 cloud metadata, RFC1918 ranges) occurs. The server therefore acts as a proxy to any address reachable from its network position, and returns the fetched content to the caller.
Know when Lobehub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Network-reachable with low-privilege auth (PR:L) and no UI; SSRF reaches other internal systems so scope changes (S:C) with high confidentiality but no integrity/availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.
Executive ViewAI
LobeChat versions before 2.2.10-canary.18 contain a vulnerability that exposes cloud credentials and internal data to authenticated users. A vendor patch is available, and publicly available exploit code exists but has not been observed in active attacks-patching within the next week will eliminate this risk.
Apply vendor patch: LobeChat 2.2.10-canary.18 or later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Lobe Chat is an open-source artificial intelligence chat framework. Rated high severity (CVSS 8.8), this vulnerability i
Lobe Chat is an open-source, AI chat framework. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab
Denial of service in LobeChat before 2.2.10-canary.15 lets an authenticated user hang the entire Node.js server by impor
Cross-user data disclosure in LobeChat through version 2.2.9 allows any authenticated user to read other users' document
Lobe Chat is an open-source LLMs/AI chat framework. Rated medium severity (CVSS 5.7), this vulnerability is remotely exp
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
Path traversal in LobeHub Chat (npm @lobehub/chat, versions 1.84.26 through 2.1.48) lets any authenticated user write ar
Lobe Chat is an open-source artificial intelligence chat framework. Rated medium severity (CVSS 4.3), this vulnerability
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScri
Webhook signature verification bypass in LobeChat 2.2.1 allows unauthenticated remote attackers to inject forged inbound
Broken object level authorization in LobeChat through version 2.2.9 permits authenticated users to read and manipulate c
Exploit-DB