Openmaic
Monthly
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.