Which versions of LobeChat are affected by EUVD-2026-41426?

LobeChat versions before 2.2.10-canary.18 contain a vulnerability that exposes cloud credentials and internal data to authenticated users.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-41426?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41426. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-41426?

Within 24 hours: Inventory all LobeChat deployments and document their current versions. Within 7 days: Upgrade all affected instances to LobeChat 2.2.10-canary.18 or later. Within 30 days: Review access logs for suspicious requests to internal endpoints and audit cloud credential access patterns.

LobeChat EUVD-2026-41426

Q: What is the CVSS score of EUVD-2026-41426?

EUVD-2026-41426 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-59095 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-02 VulnCheck

GHSA-r2cx-cpfx-9h63

SSRF Lobehub

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable with low-privilege auth (PR:L) and no UI; SSRF reaches other internal systems so scope changes (S:C) with high confidentiality but no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:32 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

7.7 (HIGH) 8.3 (HIGH)

DescriptionCVE.org

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.

AnalysisAI

Server-side request forgery in LobeChat before 2.2.10-canary.18 lets authenticated users coerce the server into issuing internal HTTP requests to attacker-chosen URLs, enabling disclosure of internal service responses and cloud credentials from instance metadata endpoints. The flaw stems from two endpoints - skill import (importFromUrl) and topic cover update (fetchImageFromUrl) - calling the global fetch instead of the project's ssrf-safe-fetch wrapper. Publicly available exploit code exists and a vendor patch has shipped, though it is not listed in CISA KEV.

Technical ContextAI

LobeChat is an open-source AI/LLM chat framework (vendor lobehub). The vulnerability is a classic CWE-918 Server-Side Request Forgery: the application maintains an SSRF-protective HTTP client (ssrf-safe-fetch) intended to validate and restrict outbound request destinations, but two features bypass it by invoking the raw global fetch. The skill import service resolves a user-supplied URL (importFromUrl) and the topic cover feature retrieves a user-supplied image URL (fetchImageFromUrl); because neither path routes through the safe wrapper, no allow-listing or blocking of internal/link-local addresses (e.g., 169.254.169.254 cloud metadata, RFC1918 ranges) occurs. The server therefore acts as a proxy to any address reachable from its network position, and returns the fetched content to the caller.

RemediationAI

Upgrade to LobeChat 2.2.10-canary.18 or later, which routes the affected endpoints through the ssrf-safe-fetch wrapper (see fixing PR https://github.com/lobehub/lobehub/pull/16601 and advisory https://www.vulncheck.com/advisories/lobechat-canary-18-ssrf-via-importfromurl-and-fetchimagefromurl). If immediate patching is not possible, apply compensating controls: at the network layer, deny the LobeChat server egress to link-local (169.254.169.254) and RFC1918 internal ranges, or enforce IMDSv2 / disable IMDSv1 on cloud instances so metadata cannot be read via a simple GET - trade-off is that legitimate outbound image/skill fetches to blocked ranges will also fail. Restrict or disable self-registration and limit accounts to trusted users to raise the PR:L bar, and consider disabling or gating the skill import and topic-cover-from-URL features if not required, at the cost of losing that functionality. Note this is an upstream code fix confirmed by a tagged canary release; verify the running version after upgrade.