Automatisch EUVD-2026-55240

Exploitation requires an authenticated session with a user account that holds the 'manage Flow' permission within the Automatisch application; CVSS PR:L confirms a low-privilege authenticated account suffices, not an administrator. The HTTP Request app with its Custom Request action must be available in the Automatisch instance (it appears to be a built-in app). No special network position is required from the attacker's perspective - the request originates from the server. Exploitation is limited by: (1) the requirement for a valid Automatisch account with the specific 'manage Flow' role, meaning unauthenticated external attackers are excluded; (2) the impact on subsequent systems depends on what internal hosts or metadata services are reachable from the server's network position - instances with no metadata service or strict egress filtering face reduced impact; (3) IMDSv2-enforced cloud environments prevent metadata credential theft but do not prevent SSRF to other internal services.

The CVSS 7.7 score is well-calibrated for this vulnerability: AV:N confirms exploitation is fully remote, AC:L and UI:N mean no preconditions or victim interaction are needed beyond possessing the 'manage Flow' role, and S:C/C:H reflects the high-value data accessible via server-side pivoting to internal infrastructure. The exploitation bar is notably low - even a mid-sized municipal IT team in opole operating a self-hosted Automatisch instance should treat this as an urgent remediation given that cloud-hosted deployments are directly exposed to metadata credential theft (AWS IMDSv1, GCP, Azure IMDS), which can escalate SSRF to full account compromise. No EPSS score was provided, and no CISA KEV listing exists, so empirical exploitation frequency cannot be quantified; however, SSRF vulnerabilities targeting metadata services are well-understood and routinely exploited in cloud environments, making the theoretical risk concrete. The absence of a published exploit lowers immediate urgency slightly but does not offset the low privilege bar and changed scope.

An attacker with a low-privileged Automatisch account granted the 'manage Flow' permission creates a new flow using the HTTP Request app's Custom Request action and sets the URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 metadata endpoint). The Automatisch backend fetches the URL server-side and returns the full response body - including temporary AWS IAM credentials - to the attacker's browser, enabling lateral movement into cloud infrastructure without any additional exploitation. No public proof-of-concept code was identified, but the attack requires only standard HTTP tooling and knowledge of the target's cloud provider.