Label Studio EUVD-2026-56030

Exploitation requires a valid Label Studio user account at any privilege level, including standard annotator accounts, as indicated by the PR:L CVSS metric. The critical enabling condition is that SSRF_PROTECTION_ENABLED is set to false, which is the out-of-the-box default for all Label Studio installations through 1.24.0.dev0 - no additional misconfiguration is required to be vulnerable. The import-from-URL endpoint must be reachable by the attacker's authenticated session. Exploitation is bounded to confidentiality impact only: no write access or service disruption is achievable through this vector. The highest-impact scenario (cloud credential theft via instance metadata) is further limited to deployments in cloud environments where IMDSv1 is enabled or IMDSv2 is not enforced; deployments with mandatory IMDSv2 or no attached instance metadata service reduce this risk. On-premises deployments remain vulnerable to SSRF against whatever internal services are network-reachable from the Label Studio host.

The CVSS 6.5 Medium score reflects the authentication requirement (PR:L) that bounds the attack surface to credentialed users, while correctly capturing the high confidentiality impact from potential cloud credential theft. The low attack complexity and network vector mean any authenticated annotator - not just administrators - can exploit this without specialized tooling. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation modeling. There is no CISA KEV entry and no confirmed public exploit code, making this a credible but not imminently weaponized threat at time of analysis. The default-off protection flag is the most operationally significant signal: this is not a logic flaw requiring a patch but a configuration gap requiring an operator action, meaning the remediation surface is entirely within deployment configuration rather than vendor code. Cloud-hosted deployments where IMDSv2 is not enforced face the highest concrete risk - credential theft via metadata endpoint is a well-documented escalation path. On-premises deployments face SSRF to internal services, whose severity depends on what is reachable from the Label Studio server. The absence of EPSS and KEV data means defenders should weight the ease-of-exploitation (AC:L, PR:L, no UI) and default-vulnerable state heavily in their prioritization.

An annotator with a standard Label Studio account submits an import task pointing the import-from-URL endpoint to http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted Label Studio instance. The server fetches the URL server-side and returns the IAM role's temporary access key, secret, and session token in the response, which the attacker uses to authenticate directly to AWS services and escalate privileges. The attack requires only a browser and valid Label Studio credentials - no exploit code or network position is needed.