Zilliz Attu EUVD-2026-91835

Exploitation requires network access to an Attu instance's Playground feature, which proxies user-supplied requests without validating the destination, allowing the attacker to specify private/internal IP addresses. Affected: Attu versions before 3.0.0. Limiting factors: the attacker must be able to reach the Attu web UI (commonly an internally deployed administration tool rather than an internet-facing service), the Playground feature must be present/accessible, and the vendor-rated AC:H implies some additional conditions beyond a trivially crafted request may apply. Authentication requirements are not confirmed from available data - the CVSS vector states PR:N (unauthenticated), but whether the Playground enforces authentication in typical deployments is not established in the input.

This is a moderate-severity, not high-priority, issue. The input CVSS base score is 4.0 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N - network-reachable and requiring no authentication or user interaction, but rated high attack complexity (AC:H) with only a limited integrity impact and a scope change. No EPSS score, CISA KEV listing, or explicit POC flag was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The one confidence-raising signal is a Bishop Fox security-research blog in the references, which indicates the flaw has been publicly analyzed (notably against Attu 2.6.5) even though no weaponized exploit is confirmed. Conflicting signals worth noting: the vendor-supplied vector marks AC:H, yet SSRF-via-a-request-proxy is typically low-complexity (just supplying an internal URL), so the AC:H rating may understate ease of exploitation - verify against the Bishop Fox write-up. Also, the impact is recorded as integrity-only (I:L, C:N), whereas classic SSRF usually yields confidentiality exposure of internal responses; this should be confirmed. Net: a real but bounded internal-pivot/SSRF risk, most relevant where Attu is network-exposed, rather than an emergency patch item absent exploitation data.

An attacker who can reach the Attu web interface uses the Playground feature to submit a request whose destination is an internal/private IP address; Attu proxies the request on the server's behalf, letting the attacker probe or interact with internal services (e.g., cloud metadata endpoints, internal admin APIs, or other hosts) not otherwise reachable. No public exploit is identified at time of analysis, though the technique is documented in a Bishop Fox research blog.