SSRF
Monthly
SSRF in Plunk email platform before 0.7.0.
Flowise versions prior to 3.0.13 allow unauthenticated users to trigger Server-Side Request Forgery (SSRF) attacks through improperly validated URLs in the HTTP Node component, enabling attackers to probe internal networks and cloud metadata endpoints from the Flowise server. Public exploit code exists for this vulnerability, and no patch is currently available for affected deployments. Any organization running a publicly exposed Flowise instance is at immediate risk of internal network reconnaissance and potential credential theft from cloud environments.
Server-side request forgery in LinkAce allows authenticated users to make arbitrary HTTP requests to internal network addresses and cloud metadata endpoints by providing malicious URLs during link creation, bypassing validation controls that exist elsewhere in the application. An attacker with valid credentials can exploit this to access Docker service hostnames, internal services, and sensitive metadata endpoints. No patch is currently available for this vulnerability affecting PHP-based LinkAce deployments.
Unauthenticated attackers can abuse the MCP Atlassian server to perform arbitrary outbound HTTP requests by manipulating HTTP headers, enabling credential theft from cloud instance metadata endpoints or internal network reconnaissance without requiring authentication. The vulnerability exists in the HTTP middleware layer prior to version 0.17.0, affecting Atlassian Confluence and Jira deployments. No patch is currently available.
pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver component that allows unauthenticated remote attackers to access sensitive information through crafted URL requests. Affected applications using vulnerable versions without proper URL access controls are at risk of information disclosure. No patch is currently available, though version 0.3.6 introduces URL access policy controls to mitigate the risk.
Azure IoT Explorer is vulnerable to server-side request forgery that enables unauthenticated network-based attackers to perform spoofing attacks and access sensitive information. The vulnerability requires no user interaction and can be exploited remotely with low attack complexity, affecting the confidentiality of exposed data. No patch is currently available.
Authenticated users can exploit a server-side request forgery vulnerability in Azure MCP Server to escalate their privileges across the network, potentially gaining unauthorized access to sensitive resources. The vulnerability affects Microsoft Azure environments and requires only low attack complexity with no user interaction, making it a significant risk for organizations using this service. No patch is currently available, leaving affected systems exposed to exploitation.
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server into fetching attacker-chosen internal URLs, bypassing the allowed_media_domains allowlist that was added to fix CVE-2026-24779. The bypass exploits a backslash-before-@ parsing disagreement between urllib3.util.parse_url (validation layer) and aiohttp/yarl (HTTP client), so a URL the allowlist reads as a permitted host is actually fetched from an internal target. It carries a CVSS 9.8 rating, a vendor patch and Red Hat advisory are available, and a working bypass payload is published in the GHSA advisory and fix test suite, though EPSS is very low (0.02%, 3rd percentile) and it is not on CISA KEV.
IKEA Dirigera v2.866.4 contains a server-side request forgery vulnerability that enables authenticated attackers with high privileges to extract private cryptographic keys through specially crafted requests. The vulnerability impacts the confidentiality of sensitive authentication material while also introducing integrity and availability risks, though no patch is currently available.
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. [CVSS 7.5 HIGH]
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network requests through the notification tester functionality. An attacker with user privileges can exploit this to access internal services, retrieve sensitive data, or interact with backend systems on behalf of the server. Public exploit code exists for this vulnerability, though a patch is available in version 4.6.2.
Plane is an an open-source project management tool. [CVSS 8.5 HIGH]
Server-Side Request Forgery in Wekan 8.32-8.33 allows authenticated users to force the server to make arbitrary HTTP requests by supplying malicious attachment URLs during board imports from JSON data or Trello. An attacker could exploit this to access internal network services, cloud metadata endpoints, or expose sensitive credentials without any URL validation occurring on the server side.
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs...
SSRF in Ghostfolio wealth management before 2.245.0. Patch available.
OpenSift versions prior to 1.6.3-alpha are vulnerable to server-side request forgery (SSRF) attacks through the URL ingest pipeline, which fails to properly validate credentialed URLs, non-standard ports, and cross-host redirects in non-localhost deployments. An unauthenticated remote attacker can exploit this to access internal resources and potentially exfiltrate sensitive data from the affected system. No patch is currently available for this vulnerability.
Idno prior to version 1.6.4 contains an authentication bypass in the URL unfurl API endpoint that allows unauthenticated attackers to trigger arbitrary outbound HTTP requests from the server. An attacker can exploit this to access internal network addresses and cloud metadata services, potentially exposing sensitive configuration and credentials. No patch is currently available for affected installations.
OpenClaw versions before 2026.2.14 contain unprotected server-side request forgery flaws in the Feishu extension that enable remote attackers to access internal services and exfiltrate data without authentication. Attackers can exploit the sendMediaFeishu function and markdown image processing through direct manipulation or prompt injection to force the application to fetch attacker-controlled URLs and re-upload responses as Feishu media. A patch is available to remediate this network-accessible vulnerability affecting AI/ML deployments.
Code injection bypass in Craft CMS before 5.9.0-beta.1/4.17.0-beta.1 via blocklist evasion. Patch available.
The PostX WordPress plugin versions up to 5.0.8 contains a server-side request forgery vulnerability in its REST API endpoints that allows authenticated administrators to make arbitrary web requests from the server to internal or external systems. This could enable attackers with admin privileges to query, exfiltrate, or modify data from internal services accessible to the web server. No patch is currently available for this vulnerability.
Server-Side Request Forgery in the Uncanny Automator WordPress plugin up to version 7.0.0.3 allows authenticated administrators to make arbitrary web requests from the affected server and store remote file contents locally, potentially enabling remote code execution. The vulnerability requires administrator-level privileges and has no available patch. Attackers can exploit this to interact with internal services and upload arbitrary files to the web server.
Server-Side Request Forgery in Gradio prior to version 6.6.0 allows attackers to execute arbitrary HTTP requests through a victim's infrastructure by crafting a malicious Space with a poisoned proxy_url configuration. Applications that load untrusted Gradio Spaces via gr.load() are vulnerable to attacks targeting internal services, cloud metadata endpoints, and private networks. No patch is currently available for affected Python/ML applications.
Xerox FreeFlow Core versions through 8.0.7 contain an XML External Entity (XXE) vulnerability that allows unauthenticated remote attackers to conduct Server-Side Request Forgery attacks by submitting malicious XML input. This vulnerability could enable attackers to access internal resources or sensitive data on the affected system. A patch is currently unavailable, though Xerox recommends upgrading to version 8.1.0.
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana server filesystem, and perform Server-Side (CVSS 8.6).
Plane versions before 1.2.2 contain a server-side request forgery vulnerability in the "Add Link" feature that allows authenticated users to send arbitrary GET requests to internal networks and retrieve full response bodies. An attacker with basic user privileges can exploit this to steal sensitive data from internal services and cloud metadata endpoints. No patch is currently available.
esm.sh versions up to 137 contain an SSRF vulnerability in the `/http(s)` fetch route that allows remote attackers to bypass hostname validation through DNS alias domains and access internal localhost services. Public exploit code exists for this vulnerability, and no patches are currently available. This affects users of esm.sh CDN services and any applications relying on the affected versions.
changedetection.io is a free open source web page change detection tool. [CVSS 8.6 HIGH]
Server-side request forgery in AVideo prior to version 22.0 allows authenticated users to make arbitrary outbound requests from the affected server via an unvalidated downloadURL parameter in the aVideoEncoder.json.php endpoint. An attacker can exploit this to probe internal network services, access metadata endpoints, and retrieve sensitive data, potentially leading to further system compromise. This affects PHP deployments running vulnerable AVideo versions.
Astro web framework versions prior to 9.5.4 contain a server-side request forgery vulnerability in error page handling that allows unauthenticated remote attackers to bypass Host header validation and redirect requests to internal services or cloud metadata endpoints. By manipulating the Host header when accessing prerendered error pages, attackers can read response bodies from internal URLs, cloud metadata services, or localhost resources. Public exploit code exists for this vulnerability, which affects applications using custom error pages without proper Host validation.
OpenClaw versions 2026.2.17 and earlier allow unauthenticated remote attackers to access internal and metadata endpoints through unprotected cron webhook delivery mechanisms that lack SSRF validation. An attacker can exploit this to reach private services and endpoints that should be restricted, potentially leading to information disclosure or lateral movement within the infrastructure. A patch is available in version 2026.2.19.
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the logo upload feature by exploiting HTTP redirects that bypass IP validation checks, enabling access to internal resources and cloud metadata endpoints. Public exploit code exists for this vulnerability, and an available patch should be applied immediately to prevent unauthorized disclosure of sensitive configuration and credentials.
OpenClaw prior to version 2026.2.14 fails to properly validate IPv6-formatted addresses in its SSRF protection, allowing attackers to bypass restrictions and access loopback and private network resources that should be blocked. An unauthenticated remote attacker can exploit this by crafting requests using IPv4-mapped IPv6 literals to reach restricted endpoints. The vulnerability has been patched in version 2026.2.14.
OpenClaw versions prior to 2026.2.14 fail to validate the gatewayUrl parameter in the Gateway tool, allowing authenticated users or operators to redirect WebSocket connections to arbitrary targets and potentially access internal resources. This vulnerability requires authentication and the ability to invoke specific tool calls, limiting exposure to trusted users and automated systems rather than anonymous attackers. An attacker with these privileges could establish unauthorized outbound connections from the OpenClaw host, compromising confidentiality and potentially enabling further network-based attacks.
SillyTavern versions before 1.16.0 contain a server-side request forgery (SSRF) vulnerability in the asset download endpoint that allows authenticated users to make arbitrary HTTP requests from the server and access internal services, cloud metadata, and private network resources. Public exploit code exists for this vulnerability, which can be mitigated by upgrading to version 1.16.0 or configuring domain whitelisting in the config.yaml file.
Remote code execution in Hyland's Alfresco Transform Service (and the related Alfresco Transform Core component) lets unauthenticated network attackers inject crafted arguments into the document-processing pipeline to run arbitrary commands on the transformation host. Any exposed Alfresco deployment relying on these transform components is affected, with no login required and full compromise of confidentiality, integrity and availability. No public exploit has been identified at time of analysis, and the EPSS probability is currently low (0.22%, 44th percentile).
Arbitrary file read and server-side request forgery in Hyland Alfresco Transformation Service (and the underlying Alfresco Transform Core, including 5.3.0-alpha1) allow unauthenticated remote attackers to read arbitrary files and coerce the server into making outbound requests via absolute path traversal. Hyland has published a coordinated security advisory (CVE-2026-26337/26338/26339). No public exploit has been identified at time of analysis and the EPSS probability is low (0.12%), but the network-facing, unauthenticated nature makes this a meaningful exposure for internet-reachable transform components.
GitHub Enterprise Server allows authenticated webhook administrators to bypass network restrictions through Server-Side Request Forgery, enabling access to internal services, job queues, and sensitive endpoints on loopback addresses. This affects all versions prior to 3.20 and requires valid credentials with webhook configuration privileges. No patch is currently available, and exploitation could lead to unauthorized data access or disruption of background job processing.
Configuration deletion and resource denial in StorageGRID versions before 11.9.0.12 and 12.0.0.4 stems from an SSRF flaw in Microsoft Entra ID SSO integration, allowing authenticated attackers to manipulate backend requests. Successful exploitation enables deletion of configuration data or denial of access to storage resources despite requiring valid credentials to initiate the attack.
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import feature that allows authenticated users to bypass URL validation after HTTP redirects, enabling attacks against internal networks and cloud metadata services. An attacker with standard user privileges can leverage this flaw to scan internal ports, access sensitive metadata, or discover the server's real IP address. Public exploit code exists for this vulnerability.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
All In One Image Viewer Block (WordPress plugin) is affected by server-side request forgery (ssrf) (CVSS 7.2).
TrustTunnel versions prior to 0.9.114 fail to validate private network restrictions when processing numeric IP addresses in TCP connections, enabling authenticated attackers to bypass SSRF protections and reach loopback or internal network targets. The vulnerability exists because IP-based connection requests skip the same security checks applied to hostname-based requests. Public exploit code exists; upgrade to version 0.9.114 or later to remediate.
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where inconsistent URL parsing between libraries allows attackers to bypass host restrictions and force the server to make arbitrary requests to internal network resources. Public exploit code exists for this vulnerability, which poses significant risk in containerized environments where a compromised vLLM instance could be leveraged to access restricted internal systems. The vulnerability affects users running vLLM's multimodal features with untrusted input.
Server-Side Request Forgery (SSRF) vulnerability in Squidex CMS webhook configuration allows authenticated administrators to make requests to internal services by specifying localhost or internal IP addresses as webhook destinations. PoC available.
XXE (XML External Entity) injection in AssertJ Java testing library from 1.4.0 to before 3.27.7 allows reading arbitrary files when parsing XML assertions. Patch available.
Unauthenticated attackers can exploit a Server-Side Request Forgery vulnerability in the WordPress Frontis Blocks plugin (versions up to 1.1.6) through unvalidated URL parameters in the template proxy endpoints to perform arbitrary web requests from the affected server. This allows an attacker to scan internal networks, access local services, or exfiltrate sensitive data without authentication. No patch is currently available.
Unauthenticated Server-Side Request Forgery (SSRF) in FOG 1.5.10.1754 and earlier allows remote attackers to read internal files and access local services by manipulating the url parameter in getversion.php when newService=1 is present. The vulnerability requires no authentication or user interaction and affects the confidentiality of sensitive data accessible from the affected system. No patch is currently available.
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attacker-supplied URL, exposing internal network services and cloud metadata endpoints. The flaw lives in the /project/element update flow specifically when Chainlit is deployed with the SQLAlchemy data layer backend, whose element-creation logic issues an outbound HTTP GET against a user-controlled url field and persists the response through the configured storage provider. Publicly available exploit code exists (documented in Zafran's 'ChainLeak' research), though the flaw is not listed in CISA KEV and its EPSS probability is low at 0.04%.
Arbitrary file read vulnerability in Kafka Connect BigQuery Connector prior to version 2.11.0 allows authenticated attackers to read sensitive files by injecting malicious credential configurations through improperly validated credential_source parameters. An attacker with connector configuration privileges can exploit this to access arbitrary files on the system or perform server-side request forgery attacks against internal endpoints. No patch is currently available for affected Apache Kafka deployments.
The Librarian's web_fetch tool can be exploited via SSRF to perform unauthorized GET requests against internal IP addresses and cloud services within the Hertzner environment, allowing attackers to conduct port scanning and reconnaissance of the infrastructure. This unauthenticated network-based attack requires no user interaction and could expose sensitive internal services and their configurations. While the vendor has released patches, exploitation remains possible on unpatched instances.
The Google Gemini connector in AI/ML products allows authenticated users with connector management privileges to read arbitrary files through unvalidated file path and network request parameters in credential configurations. An attacker with sufficient authentication access can craft malicious JSON payloads to trigger server-side requests and disclose sensitive files from the affected system. This vulnerability requires valid credentials and administrative privileges but presents a high risk of confidential data exposure.
Mastodon's IP address filtering bypass (CWE-918) permits attackers to craft requests using unblocked IP ranges to reach local and loopback services, potentially exposing private resources and internal APIs. An unauthenticated remote attacker can exploit incomplete private address range validation in Mastodon instances to perform Server-Side Request Forgery (SSRF) attacks. Patched versions 4.5.4, 4.4.11, 4.3.17, and 4.2.29 are available.
Server-side request forgery (SSRF) in Emlog up to version 2.5.19 allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files to the media upload endpoint, enabling internal network reconnaissance and potential credential exposure when the server processes the files. Public exploit code exists for this vulnerability and no patches are currently available. The flaw affects all Emlog installations accepting SVG uploads and can be exploited without user interaction once an attacker gains authenticated access.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis.
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Skype for Business Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
TorchServe is a tool for serving and scaling PyTorch models in production. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthenticated attackers to access Exchange backend services and achieve remote code execution when chained with CVE-2021-34523 and CVE-2021-31207.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows unauthenticated attackers to access Exchange backend services, chain with other vulnerabilities for full server compromise. The most impactful Exchange vulnerability in history.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Server-side request forgery in fish-island-backend through commit 7c61b78 allows unauthenticated remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse, potentially reaching internal hosts, loopback services, and cloud metadata endpoints through redirect-following OkHttp requests. Successful exploitation can disclose limited internal data reflected by the parser, such as page titles, meta descriptions, and favicons, so the practical impact is constrained to what the targeted service returns in those fields. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated remote attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. The FetchLinkCardService follows redirects and skips TLS verification, enabling access to loopback, private, or cloud metadata addresses; the impact is limited because only the fetched page's title and description are returned, not full response bodies. No public exploit identified at time of analysis; CVSS 4.0 score 6.9 (Medium) reflects unauthenticated network access with low confidentiality impact.
Server-side request forgery in SparkyFitness (self-hosted AI health and fitness tracker) before version 1.6.0 lets an authenticated user point the built-in custom AI service configuration at arbitrary internal or private network addresses, causing the server to issue outbound POST requests carrying an attacker-controlled bearer token and to leak the AI system prompt. Exploitation requires a valid account and the ability to save a custom AI provider URL (custom, ollama, or openai_compatible) and then trigger an AI flow such as chat or the label/food-photo scan, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is bounded to internal-service probing, forged outbound POSTs, and prompt disclosure rather than code execution. The issue is fixed in 1.6.0, which enforces an outbound URL policy that rejects private-network AI destinations with HTTP 403 by default.
Server-side request forgery in the PingOne groups endpoint of Devolutions Server 2026.3.8.0 and earlier lets an authenticated user with low privileges supply an attacker-controlled PingOne configuration in a request parameter and cause the server to act on it, resulting in exfiltration of the stored PingOne application secret. The issue carries a CVSS base score of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), is limited to a confidentiality impact on the PingOne secret, and only affects instances where the PingOne integration is configured with a stored application secret. No public exploit code has been identified at time of analysis, and a vendor patch is available.
Server-side request forgery in the Apache Kylin job-driver UI proxy (versions 4.0.0 through 5.0.4) allows an attacker to induce the Kylin job service to issue requests to attacker-chosen destinations, potentially reaching internal services or cloud metadata endpoints that the Kylin host can access. The vendor explicitly scopes real-world risk to deployments where the job service and its UI proxy are directly exposed to the public network, describing that configuration as uncommon and stating that in-house, segmented Kylin deployments are 'mostly not impacted'; exploitation prerequisites are therefore dominated by network exposure rather than by any inherent weakness in default internal deployments. No public exploit code, EPSS score, KEV listing, or vendor-published CVSS vector was available at time of analysis, so there is no public exploit identified at time of analysis and the issue carries a moderate severity rating; upgrading to 5.0.5 removes the condition (tracked as KYLIN-6104).
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Unauthenticated server-side request forgery in RedAmon through 7.0.1 allows any attacker who can reach the agent API to make the server issue outbound requests to attacker-chosen URLs via POST /tradecraft/verify, including internal services and cloud metadata endpoints such as 169.254.169.254, with the fetched content returned to the attacker through the model-generated summary. The defect is that the validate_url routine inspects only the initially submitted hostname, so a public URL that returns an HTTP redirect or uses DNS rebinding to resolve into internal address space after the check bypasses the validation entirely (CWE-918). No authentication is required (PR:N per both the CVE 4.0 vector and the independent CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N assessment), the assessed impact is confidentiality-only, and no public exploit code was identified at time of analysis. The practical limiting factor is network reachability of the RedAmon agent API, and the cloud-metadata impact additionally depends on the deployment having a reachable metadata service or sensitive internal endpoints from the server.
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.
Unauthenticated server-side request forgery in ValueCell through 0.1.20 lets any party that can reach the server API set an unvalidated provider base_url and then force the backend to issue requests to attacker-chosen destinations via POST /api/v1/models/check, enabling probing of internal hosts and cloud metadata addresses, leakage of error-response content, and potential capture of stored provider API keys. The flaw is CWE-918 and rated 6.9 (Medium) under CVSS 4.0 with AV:N/AC:L/AT:N/PR:N/UI:N, meaning it is network-reachable and requires no authentication or user interaction; it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, although a public technical write-up documents the attack path. Real-world impact is bounded by deployment context: the API must be reachable from an untrusted network, metadata access requires the instance to run where a link-local metadata service is exposed, and provider-key theft requires providers to already be configured with stored credentials, which our independent assessment reflects with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Server-side request forgery in web3.py's CCIP Read (EIP-3668) URL handling (CVE-2026-111171) allows a malicious or attacker-controlled smart contract to make victim applications issue outbound HTTP requests to loopback, RFC1918, or link-local destinations, including cloud metadata services such as 169.254.169.254. The flaw affects web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0, and is reachable unauthenticated (CVSS:4.0 PR:N, AV:N) by any backend, indexer, bot, or API that performs .call()/eth_call against untrusted contracts, since CCIP Read is enabled by default (global_ccip_read_enabled=True). Exploitation requires the attacker to deliberately craft an IPv4-mapped IPv6 host (e.g. ::ffff:127.0.0.1) or AAAA record that bypasses _check_ip_blocked(), so the attack is automatable only with specific crafting (SSVC Automatable: no); publicly available exploit code exists, impact is partial (low confidentiality and integrity), and the issue is not currently listed in CISA KEV.
Server-side request forgery in Helium Platform before 2.2.60 lets any authenticated user force the server to issue outbound HTTP requests to arbitrary internal or external hosts by storing a crafted URL as an external calendar feed, enabling host and port reconnaissance through response differences and unhandled RemoteDisconnected errors. The vulnerable path is the default external-calendar feature, and the periodic refetch in fetch_ical_conditional makes the requests repeatable, though the advisory confirms only forced outbound requests and internal reachability-not secret exfiltration. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; the vendor-aligned CVSS is 4.3.
Server-side request forgery in the Lychee photo-management tool before 7.6.0 lets an authenticated user who can reach the POST /api/v2/Photo::fromUrl URL-import endpoint steer server-side fetches toward private or otherwise forbidden destinations by manipulating DNS answers between the validation step and the download step. The flaw is a classic time-of-check to time-of-use (CWE-367) DNS-rebinding race: app/Rules/PhotoUrlRule.php resolves and approves the submitted hostname, but app/Actions/Import/FromUrl.php later passes the original hostname to app/Image/Files/DownloadedFile.php, which opens a completely separate connection and resolves that hostname again, so an attacker controlling authoritative DNS for the name can return a public address to the check and a private address to the fetch. Exploitation requires a valid Lychee account (PR:L) and precise timing against the second resolution (AC:H), and real-world impact is bounded by which internal services the Lychee host can actually reach and by TLS behavior on the fetched connection, as the vendor advisory notes; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in Matomo 5.11.2 allows an attacker holding a low-privilege authenticated account to make the application issue HTTP requests to arbitrary destinations through the SiteContentDetector/SitesManager functionality, disclosing limited sensitive information from internal or otherwise unreachable services. The vulnerability is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) as a CWE-918 SSRF, so exploitation requires credentials but no user interaction, and impact is confined to confidentiality with no integrity or availability effect. Publicly available proof-of-concept code exists (SSVC exploitation status: poc; a dedicated CVE-2026-78850 demonstration repository is referenced), but there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in Palo Alto Networks Checkov by Prisma Cloud before version 3.2.533 allows a local unauthenticated attacker to induce the tool to make unauthorized network requests from the host to internal services. The attacker must influence Infrastructure-as-Code content parsed by Checkov, and a victim must run a scan on a host with network reachability to the target services; it is not remotely triggerable. No public exploit code has been identified, and the impact is limited to low-severity SSRF without confidentiality or integrity impact on the Checkov host itself, though other systems may experience low confidentiality impact. A vendor patch is available in version 3.2.533.
Server-side request forgery in InvoiceShelf before version 2.4.0 lets an authenticated owner-level administrator point the user-controlled gotenberg_host setting at arbitrary internal addresses, causing the application to POST rendered invoice, estimate, or payment HTML to that destination during PDF generation. Affected deployments are those running a version prior to 2.4.0 with the Gotenberg PDF driver enabled; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N (CVSS 6.8), so the attack is gated behind high privileges and requires a PDF render to actually occur. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation; the primary risk is internal service and cloud metadata (169.254.169.254) reachability plus exfiltration of customer names, addresses, line items, totals, and company identifiers to an attacker-chosen host.
SSRF in Plunk email platform before 0.7.0.
Flowise versions prior to 3.0.13 allow unauthenticated users to trigger Server-Side Request Forgery (SSRF) attacks through improperly validated URLs in the HTTP Node component, enabling attackers to probe internal networks and cloud metadata endpoints from the Flowise server. Public exploit code exists for this vulnerability, and no patch is currently available for affected deployments. Any organization running a publicly exposed Flowise instance is at immediate risk of internal network reconnaissance and potential credential theft from cloud environments.
Server-side request forgery in LinkAce allows authenticated users to make arbitrary HTTP requests to internal network addresses and cloud metadata endpoints by providing malicious URLs during link creation, bypassing validation controls that exist elsewhere in the application. An attacker with valid credentials can exploit this to access Docker service hostnames, internal services, and sensitive metadata endpoints. No patch is currently available for this vulnerability affecting PHP-based LinkAce deployments.
Unauthenticated attackers can abuse the MCP Atlassian server to perform arbitrary outbound HTTP requests by manipulating HTTP headers, enabling credential theft from cloud instance metadata endpoints or internal network reconnaissance without requiring authentication. The vulnerability exists in the HTTP middleware layer prior to version 0.17.0, affecting Atlassian Confluence and Jira deployments. No patch is currently available.
pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver component that allows unauthenticated remote attackers to access sensitive information through crafted URL requests. Affected applications using vulnerable versions without proper URL access controls are at risk of information disclosure. No patch is currently available, though version 0.3.6 introduces URL access policy controls to mitigate the risk.
Azure IoT Explorer is vulnerable to server-side request forgery that enables unauthenticated network-based attackers to perform spoofing attacks and access sensitive information. The vulnerability requires no user interaction and can be exploited remotely with low attack complexity, affecting the confidentiality of exposed data. No patch is currently available.
Authenticated users can exploit a server-side request forgery vulnerability in Azure MCP Server to escalate their privileges across the network, potentially gaining unauthorized access to sensitive resources. The vulnerability affects Microsoft Azure environments and requires only low attack complexity with no user interaction, making it a significant risk for organizations using this service. No patch is currently available, leaving affected systems exposed to exploitation.
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server into fetching attacker-chosen internal URLs, bypassing the allowed_media_domains allowlist that was added to fix CVE-2026-24779. The bypass exploits a backslash-before-@ parsing disagreement between urllib3.util.parse_url (validation layer) and aiohttp/yarl (HTTP client), so a URL the allowlist reads as a permitted host is actually fetched from an internal target. It carries a CVSS 9.8 rating, a vendor patch and Red Hat advisory are available, and a working bypass payload is published in the GHSA advisory and fix test suite, though EPSS is very low (0.02%, 3rd percentile) and it is not on CISA KEV.
IKEA Dirigera v2.866.4 contains a server-side request forgery vulnerability that enables authenticated attackers with high privileges to extract private cryptographic keys through specially crafted requests. The vulnerability impacts the confidentiality of sensitive authentication material while also introducing integrity and availability risks, though no patch is currently available.
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. [CVSS 7.5 HIGH]
Server-side request forgery in Wallos versions before 4.6.2 allows authenticated attackers to conduct arbitrary network requests through the notification tester functionality. An attacker with user privileges can exploit this to access internal services, retrieve sensitive data, or interact with backend systems on behalf of the server. Public exploit code exists for this vulnerability, though a patch is available in version 4.6.2.
Plane is an an open-source project management tool. [CVSS 8.5 HIGH]
Server-Side Request Forgery in Wekan 8.32-8.33 allows authenticated users to force the server to make arbitrary HTTP requests by supplying malicious attachment URLs during board imports from JSON data or Trello. An attacker could exploit this to access internal network services, cloud metadata endpoints, or expose sensitive credentials without any URL validation occurring on the server side.
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs...
SSRF in Ghostfolio wealth management before 2.245.0. Patch available.
OpenSift versions prior to 1.6.3-alpha are vulnerable to server-side request forgery (SSRF) attacks through the URL ingest pipeline, which fails to properly validate credentialed URLs, non-standard ports, and cross-host redirects in non-localhost deployments. An unauthenticated remote attacker can exploit this to access internal resources and potentially exfiltrate sensitive data from the affected system. No patch is currently available for this vulnerability.
Idno prior to version 1.6.4 contains an authentication bypass in the URL unfurl API endpoint that allows unauthenticated attackers to trigger arbitrary outbound HTTP requests from the server. An attacker can exploit this to access internal network addresses and cloud metadata services, potentially exposing sensitive configuration and credentials. No patch is currently available for affected installations.
OpenClaw versions before 2026.2.14 contain unprotected server-side request forgery flaws in the Feishu extension that enable remote attackers to access internal services and exfiltrate data without authentication. Attackers can exploit the sendMediaFeishu function and markdown image processing through direct manipulation or prompt injection to force the application to fetch attacker-controlled URLs and re-upload responses as Feishu media. A patch is available to remediate this network-accessible vulnerability affecting AI/ML deployments.
Code injection bypass in Craft CMS before 5.9.0-beta.1/4.17.0-beta.1 via blocklist evasion. Patch available.
The PostX WordPress plugin versions up to 5.0.8 contains a server-side request forgery vulnerability in its REST API endpoints that allows authenticated administrators to make arbitrary web requests from the server to internal or external systems. This could enable attackers with admin privileges to query, exfiltrate, or modify data from internal services accessible to the web server. No patch is currently available for this vulnerability.
Server-Side Request Forgery in the Uncanny Automator WordPress plugin up to version 7.0.0.3 allows authenticated administrators to make arbitrary web requests from the affected server and store remote file contents locally, potentially enabling remote code execution. The vulnerability requires administrator-level privileges and has no available patch. Attackers can exploit this to interact with internal services and upload arbitrary files to the web server.
Server-Side Request Forgery in Gradio prior to version 6.6.0 allows attackers to execute arbitrary HTTP requests through a victim's infrastructure by crafting a malicious Space with a poisoned proxy_url configuration. Applications that load untrusted Gradio Spaces via gr.load() are vulnerable to attacks targeting internal services, cloud metadata endpoints, and private networks. No patch is currently available for affected Python/ML applications.
Xerox FreeFlow Core versions through 8.0.7 contain an XML External Entity (XXE) vulnerability that allows unauthenticated remote attackers to conduct Server-Side Request Forgery attacks by submitting malicious XML input. This vulnerability could enable attackers to access internal resources or sensitive data on the affected system. A patch is currently unavailable, though Xerox recommends upgrading to version 8.1.0.
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana server filesystem, and perform Server-Side (CVSS 8.6).
Plane versions before 1.2.2 contain a server-side request forgery vulnerability in the "Add Link" feature that allows authenticated users to send arbitrary GET requests to internal networks and retrieve full response bodies. An attacker with basic user privileges can exploit this to steal sensitive data from internal services and cloud metadata endpoints. No patch is currently available.
esm.sh versions up to 137 contain an SSRF vulnerability in the `/http(s)` fetch route that allows remote attackers to bypass hostname validation through DNS alias domains and access internal localhost services. Public exploit code exists for this vulnerability, and no patches are currently available. This affects users of esm.sh CDN services and any applications relying on the affected versions.
changedetection.io is a free open source web page change detection tool. [CVSS 8.6 HIGH]
Server-side request forgery in AVideo prior to version 22.0 allows authenticated users to make arbitrary outbound requests from the affected server via an unvalidated downloadURL parameter in the aVideoEncoder.json.php endpoint. An attacker can exploit this to probe internal network services, access metadata endpoints, and retrieve sensitive data, potentially leading to further system compromise. This affects PHP deployments running vulnerable AVideo versions.
Astro web framework versions prior to 9.5.4 contain a server-side request forgery vulnerability in error page handling that allows unauthenticated remote attackers to bypass Host header validation and redirect requests to internal services or cloud metadata endpoints. By manipulating the Host header when accessing prerendered error pages, attackers can read response bodies from internal URLs, cloud metadata services, or localhost resources. Public exploit code exists for this vulnerability, which affects applications using custom error pages without proper Host validation.
OpenClaw versions 2026.2.17 and earlier allow unauthenticated remote attackers to access internal and metadata endpoints through unprotected cron webhook delivery mechanisms that lack SSRF validation. An attacker can exploit this to reach private services and endpoints that should be restricted, potentially leading to information disclosure or lateral movement within the infrastructure. A patch is available in version 2026.2.19.
Wallos versions 4.6.0 and below allow authenticated attackers to perform Server-Side Request Forgery attacks through the logo upload feature by exploiting HTTP redirects that bypass IP validation checks, enabling access to internal resources and cloud metadata endpoints. Public exploit code exists for this vulnerability, and an available patch should be applied immediately to prevent unauthorized disclosure of sensitive configuration and credentials.
OpenClaw prior to version 2026.2.14 fails to properly validate IPv6-formatted addresses in its SSRF protection, allowing attackers to bypass restrictions and access loopback and private network resources that should be blocked. An unauthenticated remote attacker can exploit this by crafting requests using IPv4-mapped IPv6 literals to reach restricted endpoints. The vulnerability has been patched in version 2026.2.14.
OpenClaw versions prior to 2026.2.14 fail to validate the gatewayUrl parameter in the Gateway tool, allowing authenticated users or operators to redirect WebSocket connections to arbitrary targets and potentially access internal resources. This vulnerability requires authentication and the ability to invoke specific tool calls, limiting exposure to trusted users and automated systems rather than anonymous attackers. An attacker with these privileges could establish unauthorized outbound connections from the OpenClaw host, compromising confidentiality and potentially enabling further network-based attacks.
SillyTavern versions before 1.16.0 contain a server-side request forgery (SSRF) vulnerability in the asset download endpoint that allows authenticated users to make arbitrary HTTP requests from the server and access internal services, cloud metadata, and private network resources. Public exploit code exists for this vulnerability, which can be mitigated by upgrading to version 1.16.0 or configuring domain whitelisting in the config.yaml file.
Remote code execution in Hyland's Alfresco Transform Service (and the related Alfresco Transform Core component) lets unauthenticated network attackers inject crafted arguments into the document-processing pipeline to run arbitrary commands on the transformation host. Any exposed Alfresco deployment relying on these transform components is affected, with no login required and full compromise of confidentiality, integrity and availability. No public exploit has been identified at time of analysis, and the EPSS probability is currently low (0.22%, 44th percentile).
Arbitrary file read and server-side request forgery in Hyland Alfresco Transformation Service (and the underlying Alfresco Transform Core, including 5.3.0-alpha1) allow unauthenticated remote attackers to read arbitrary files and coerce the server into making outbound requests via absolute path traversal. Hyland has published a coordinated security advisory (CVE-2026-26337/26338/26339). No public exploit has been identified at time of analysis and the EPSS probability is low (0.12%), but the network-facing, unauthenticated nature makes this a meaningful exposure for internet-reachable transform components.
GitHub Enterprise Server allows authenticated webhook administrators to bypass network restrictions through Server-Side Request Forgery, enabling access to internal services, job queues, and sensitive endpoints on loopback addresses. This affects all versions prior to 3.20 and requires valid credentials with webhook configuration privileges. No patch is currently available, and exploitation could lead to unauthorized data access or disruption of background job processing.
Configuration deletion and resource denial in StorageGRID versions before 11.9.0.12 and 12.0.0.4 stems from an SSRF flaw in Microsoft Entra ID SSO integration, allowing authenticated attackers to manipulate backend requests. Successful exploitation enables deletion of configuration data or denial of access to storage resources despite requiring valid credentials to initiate the attack.
Tandoor Recipes prior to 2.5.1 contains a blind server-side request forgery vulnerability in the Cookmate recipe import feature that allows authenticated users to bypass URL validation after HTTP redirects, enabling attacks against internal networks and cloud metadata services. An attacker with standard user privileges can leverage this flaw to scan internal ports, access sensitive metadata, or discover the server's real IP address. Public exploit code exists for this vulnerability.
Pydantic AI versions 0.0.26 through 1.55.x contain a server-side request forgery vulnerability in URL download functionality that allows remote attackers to make arbitrary HTTP requests to internal network resources when applications process untrusted message history. Public exploit code exists for this vulnerability, which could enable attackers to access internal services or cloud credentials. Applications must upgrade to version 1.56.0 or later to remediate the issue.
All In One Image Viewer Block (WordPress plugin) is affected by server-side request forgery (ssrf) (CVSS 7.2).
TrustTunnel versions prior to 0.9.114 fail to validate private network restrictions when processing numeric IP addresses in TCP connections, enabling authenticated attackers to bypass SSRF protections and reach loopback or internal network targets. The vulnerability exists because IP-based connection requests skip the same security checks applied to hostname-based requests. Public exploit code exists; upgrade to version 0.9.114 or later to remediate.
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where inconsistent URL parsing between libraries allows attackers to bypass host restrictions and force the server to make arbitrary requests to internal network resources. Public exploit code exists for this vulnerability, which poses significant risk in containerized environments where a compromised vLLM instance could be leveraged to access restricted internal systems. The vulnerability affects users running vLLM's multimodal features with untrusted input.
Server-Side Request Forgery (SSRF) vulnerability in Squidex CMS webhook configuration allows authenticated administrators to make requests to internal services by specifying localhost or internal IP addresses as webhook destinations. PoC available.
XXE (XML External Entity) injection in AssertJ Java testing library from 1.4.0 to before 3.27.7 allows reading arbitrary files when parsing XML assertions. Patch available.
Unauthenticated attackers can exploit a Server-Side Request Forgery vulnerability in the WordPress Frontis Blocks plugin (versions up to 1.1.6) through unvalidated URL parameters in the template proxy endpoints to perform arbitrary web requests from the affected server. This allows an attacker to scan internal networks, access local services, or exfiltrate sensitive data without authentication. No patch is currently available.
Unauthenticated Server-Side Request Forgery (SSRF) in FOG 1.5.10.1754 and earlier allows remote attackers to read internal files and access local services by manipulating the url parameter in getversion.php when newService=1 is present. The vulnerability requires no authentication or user interaction and affects the confidentiality of sensitive data accessible from the affected system. No patch is currently available.
Server-side request forgery in Chainlit before 2.9.4 lets an authenticated user coerce the server into fetching an attacker-supplied URL, exposing internal network services and cloud metadata endpoints. The flaw lives in the /project/element update flow specifically when Chainlit is deployed with the SQLAlchemy data layer backend, whose element-creation logic issues an outbound HTTP GET against a user-controlled url field and persists the response through the configured storage provider. Publicly available exploit code exists (documented in Zafran's 'ChainLeak' research), though the flaw is not listed in CISA KEV and its EPSS probability is low at 0.04%.
Arbitrary file read vulnerability in Kafka Connect BigQuery Connector prior to version 2.11.0 allows authenticated attackers to read sensitive files by injecting malicious credential configurations through improperly validated credential_source parameters. An attacker with connector configuration privileges can exploit this to access arbitrary files on the system or perform server-side request forgery attacks against internal endpoints. No patch is currently available for affected Apache Kafka deployments.
The Librarian's web_fetch tool can be exploited via SSRF to perform unauthorized GET requests against internal IP addresses and cloud services within the Hertzner environment, allowing attackers to conduct port scanning and reconnaissance of the infrastructure. This unauthenticated network-based attack requires no user interaction and could expose sensitive internal services and their configurations. While the vendor has released patches, exploitation remains possible on unpatched instances.
The Google Gemini connector in AI/ML products allows authenticated users with connector management privileges to read arbitrary files through unvalidated file path and network request parameters in credential configurations. An attacker with sufficient authentication access can craft malicious JSON payloads to trigger server-side requests and disclose sensitive files from the affected system. This vulnerability requires valid credentials and administrative privileges but presents a high risk of confidential data exposure.
Mastodon's IP address filtering bypass (CWE-918) permits attackers to craft requests using unblocked IP ranges to reach local and loopback services, potentially exposing private resources and internal APIs. An unauthenticated remote attacker can exploit incomplete private address range validation in Mastodon instances to perform Server-Side Request Forgery (SSRF) attacks. Patched versions 4.5.4, 4.4.11, 4.3.17, and 4.2.29 are available.
Server-side request forgery (SSRF) in Emlog up to version 2.5.19 allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files to the media upload endpoint, enabling internal network reconnaissance and potential credential exposure when the server processes the files. Public exploit code exists for this vulnerability and no patches are currently available. The flaw affects all Emlog installations accepting SVG uploads and can be exploited without user interaction once an attacker gains authenticated access.
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack (CVSS 7.5).
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated access to restricted resources, used as an additional exploitation vector during the January 2024 Ivanti crisis.
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Skype for Business Elevation of Privilege Vulnerability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
TorchServe is a tool for serving and scaling PyTorch models in production. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.48 and earlier. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthenticated attackers to access Exchange backend services and achieve remote code execution when chained with CVE-2021-34523 and CVE-2021-31207.
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows unauthenticated attackers to access Exchange backend services, chain with other vulnerabilities for full server compromise. The most impactful Exchange vulnerability in history.
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Server-side request forgery in fish-island-backend through commit 7c61b78 allows unauthenticated remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse, potentially reaching internal hosts, loopback services, and cloud metadata endpoints through redirect-following OkHttp requests. Successful exploitation can disclose limited internal data reflected by the parser, such as page titles, meta descriptions, and favicons, so the practical impact is constrained to what the targeted service returns in those fields. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated remote attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. The FetchLinkCardService follows redirects and skips TLS verification, enabling access to loopback, private, or cloud metadata addresses; the impact is limited because only the fetched page's title and description are returned, not full response bodies. No public exploit identified at time of analysis; CVSS 4.0 score 6.9 (Medium) reflects unauthenticated network access with low confidentiality impact.
Server-side request forgery in SparkyFitness (self-hosted AI health and fitness tracker) before version 1.6.0 lets an authenticated user point the built-in custom AI service configuration at arbitrary internal or private network addresses, causing the server to issue outbound POST requests carrying an attacker-controlled bearer token and to leak the AI system prompt. Exploitation requires a valid account and the ability to save a custom AI provider URL (custom, ollama, or openai_compatible) and then trigger an AI flow such as chat or the label/food-photo scan, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; impact is bounded to internal-service probing, forged outbound POSTs, and prompt disclosure rather than code execution. The issue is fixed in 1.6.0, which enforces an outbound URL policy that rejects private-network AI destinations with HTTP 403 by default.
Server-side request forgery in the PingOne groups endpoint of Devolutions Server 2026.3.8.0 and earlier lets an authenticated user with low privileges supply an attacker-controlled PingOne configuration in a request parameter and cause the server to act on it, resulting in exfiltration of the stored PingOne application secret. The issue carries a CVSS base score of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), is limited to a confidentiality impact on the PingOne secret, and only affects instances where the PingOne integration is configured with a stored application secret. No public exploit code has been identified at time of analysis, and a vendor patch is available.
Server-side request forgery in the Apache Kylin job-driver UI proxy (versions 4.0.0 through 5.0.4) allows an attacker to induce the Kylin job service to issue requests to attacker-chosen destinations, potentially reaching internal services or cloud metadata endpoints that the Kylin host can access. The vendor explicitly scopes real-world risk to deployments where the job service and its UI proxy are directly exposed to the public network, describing that configuration as uncommon and stating that in-house, segmented Kylin deployments are 'mostly not impacted'; exploitation prerequisites are therefore dominated by network exposure rather than by any inherent weakness in default internal deployments. No public exploit code, EPSS score, KEV listing, or vendor-published CVSS vector was available at time of analysis, so there is no public exploit identified at time of analysis and the issue carries a moderate severity rating; upgrading to 5.0.5 removes the condition (tracked as KYLIN-6104).
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Unauthenticated server-side request forgery in RedAmon through 7.0.1 allows any attacker who can reach the agent API to make the server issue outbound requests to attacker-chosen URLs via POST /tradecraft/verify, including internal services and cloud metadata endpoints such as 169.254.169.254, with the fetched content returned to the attacker through the model-generated summary. The defect is that the validate_url routine inspects only the initially submitted hostname, so a public URL that returns an HTTP redirect or uses DNS rebinding to resolve into internal address space after the check bypasses the validation entirely (CWE-918). No authentication is required (PR:N per both the CVE 4.0 vector and the independent CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N assessment), the assessed impact is confidentiality-only, and no public exploit code was identified at time of analysis. The practical limiting factor is network reachability of the RedAmon agent API, and the cloud-metadata impact additionally depends on the deployment having a reachable metadata service or sensitive internal endpoints from the server.
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.
Unauthenticated server-side request forgery in ValueCell through 0.1.20 lets any party that can reach the server API set an unvalidated provider base_url and then force the backend to issue requests to attacker-chosen destinations via POST /api/v1/models/check, enabling probing of internal hosts and cloud metadata addresses, leakage of error-response content, and potential capture of stored provider API keys. The flaw is CWE-918 and rated 6.9 (Medium) under CVSS 4.0 with AV:N/AC:L/AT:N/PR:N/UI:N, meaning it is network-reachable and requires no authentication or user interaction; it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, although a public technical write-up documents the attack path. Real-world impact is bounded by deployment context: the API must be reachable from an untrusted network, metadata access requires the instance to run where a link-local metadata service is exposed, and provider-key theft requires providers to already be configured with stored credentials, which our independent assessment reflects with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Server-side request forgery in web3.py's CCIP Read (EIP-3668) URL handling (CVE-2026-111171) allows a malicious or attacker-controlled smart contract to make victim applications issue outbound HTTP requests to loopback, RFC1918, or link-local destinations, including cloud metadata services such as 169.254.169.254. The flaw affects web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0, and is reachable unauthenticated (CVSS:4.0 PR:N, AV:N) by any backend, indexer, bot, or API that performs .call()/eth_call against untrusted contracts, since CCIP Read is enabled by default (global_ccip_read_enabled=True). Exploitation requires the attacker to deliberately craft an IPv4-mapped IPv6 host (e.g. ::ffff:127.0.0.1) or AAAA record that bypasses _check_ip_blocked(), so the attack is automatable only with specific crafting (SSVC Automatable: no); publicly available exploit code exists, impact is partial (low confidentiality and integrity), and the issue is not currently listed in CISA KEV.
Server-side request forgery in Helium Platform before 2.2.60 lets any authenticated user force the server to issue outbound HTTP requests to arbitrary internal or external hosts by storing a crafted URL as an external calendar feed, enabling host and port reconnaissance through response differences and unhandled RemoteDisconnected errors. The vulnerable path is the default external-calendar feature, and the periodic refetch in fetch_ical_conditional makes the requests repeatable, though the advisory confirms only forced outbound requests and internal reachability-not secret exfiltration. Authentication is required (CVSS PR:L) and no public exploit has been identified at time of analysis; the vendor-aligned CVSS is 4.3.
Server-side request forgery in the Lychee photo-management tool before 7.6.0 lets an authenticated user who can reach the POST /api/v2/Photo::fromUrl URL-import endpoint steer server-side fetches toward private or otherwise forbidden destinations by manipulating DNS answers between the validation step and the download step. The flaw is a classic time-of-check to time-of-use (CWE-367) DNS-rebinding race: app/Rules/PhotoUrlRule.php resolves and approves the submitted hostname, but app/Actions/Import/FromUrl.php later passes the original hostname to app/Image/Files/DownloadedFile.php, which opens a completely separate connection and resolves that hostname again, so an attacker controlling authoritative DNS for the name can return a public address to the check and a private address to the fetch. Exploitation requires a valid Lychee account (PR:L) and precise timing against the second resolution (AC:H), and real-world impact is bounded by which internal services the Lychee host can actually reach and by TLS behavior on the fetched connection, as the vendor advisory notes; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in Matomo 5.11.2 allows an attacker holding a low-privilege authenticated account to make the application issue HTTP requests to arbitrary destinations through the SiteContentDetector/SitesManager functionality, disclosing limited sensitive information from internal or otherwise unreachable services. The vulnerability is rated CVSS 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) as a CWE-918 SSRF, so exploitation requires credentials but no user interaction, and impact is confined to confidentiality with no integrity or availability effect. Publicly available proof-of-concept code exists (SSVC exploitation status: poc; a dedicated CVE-2026-78850 demonstration repository is referenced), but there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in Palo Alto Networks Checkov by Prisma Cloud before version 3.2.533 allows a local unauthenticated attacker to induce the tool to make unauthorized network requests from the host to internal services. The attacker must influence Infrastructure-as-Code content parsed by Checkov, and a victim must run a scan on a host with network reachability to the target services; it is not remotely triggerable. No public exploit code has been identified, and the impact is limited to low-severity SSRF without confidentiality or integrity impact on the Checkov host itself, though other systems may experience low confidentiality impact. A vendor patch is available in version 3.2.533.
Server-side request forgery in InvoiceShelf before version 2.4.0 lets an authenticated owner-level administrator point the user-controlled gotenberg_host setting at arbitrary internal addresses, causing the application to POST rendered invoice, estimate, or payment HTML to that destination during PDF generation. Affected deployments are those running a version prior to 2.4.0 with the Gotenberg PDF driver enabled; the assessed vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N (CVSS 6.8), so the attack is gated behind high privileges and requires a PDF render to actually occur. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation; the primary risk is internal service and cloud metadata (169.254.169.254) reachability plus exfiltration of customer names, addresses, line items, totals, and company identifiers to an attacker-chosen host.