Dradis Community Edition EUVD-2026-65700

Exploitation requires a valid authenticated user account in Dradis Community Edition - admin privileges are explicitly not required, which is the core of the vulnerability. The attack is gated on the dradis-echo AI plugin being installed and the AI Providers/Agents management interface being accessible; installations that have not deployed this plugin or have disabled AI features are not exposed. After configuring the malicious provider, the attacker must trigger an AI interaction to cause the server-side fetch - this can be done directly by the attacker or by influencing another user. The most critical limiting factor is authentication: unauthenticated exploitation is not possible. Deployments restricted to a single administrator or a small, fully-trusted user base face significantly lower practical risk. Cloud-hosted deployments face the highest risk due to accessible link-local instance metadata endpoints (169.254.169.254) reachable from the server's network, enabling credential theft beyond just SSRF.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L) accurately reflects the threat model: exploitation is straightforward, requires only a low-privilege authenticated session, and imposes no additional attack prerequisites. The VC:H rating is well-founded given that cloud-hosted deployments expose link-local metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) that yield IAM role credentials when read, enabling lateral movement well beyond the Dradis application itself. The VI:L rating captures the ability to issue arbitrary HTTP requests to internal services, which may trigger unintended state changes even without reading responses. The provided CVSS 4.0 vector sets SC:N (no subsequent-system confidentiality impact), which conflicts with the description's explicit mention of reaching internal hosts - this discrepancy should be verified with the reporter, as an independent assessment would set SC:H to reflect that internal network services beyond the vulnerable component are reachable and their responses extractable. EPSS data was not provided in the available intelligence, preventing quantitative exploitation-probability assessment. No CISA KEV listing and no public POC have been identified, suggesting exploitation remains opportunistic rather than widespread at time of analysis. Real-world risk is highest in cloud-hosted or enterprise-VPN-connected Dradis deployments with multiple non-admin users, where the implicit trust in authenticated-but-unprivileged accounts is high and internal network segmentation at the egress layer may be absent.

An attacker with a valid non-admin Dradis account navigates to the AI Providers configuration page, creates a new provider pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1 endpoint), and reassigns the built-in Roslin agent to use it. When any AI-assisted operation is triggered, the Dradis server issues an HTTP GET to the metadata endpoint; if the response returns a non-2xx status or is otherwise flagged as an error, the full response body is reflected to the attacker's browser via ActionCable/Turbo Stream, disclosing IAM role names and temporary credentials. No public exploit code has been identified at time of analysis.