SSRF
Monthly
Server-side request forgery in the IBM i FTP server (releases 7.3, 7.4, 7.5, and 7.6) lets an authenticated FTP user bypass security restrictions and pivot to internal network services by supplying crafted PORT and EPRT commands. The flaw is an improper-validation issue (CWE-918) with a scope change because the FTP component directs connections to services outside its own security boundary; scoring is CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation requires valid FTP credentials and network reachability of the FTP service, and impact is limited to confidentiality and integrity of whatever internal services the IBM i host can reach. Per the independent assessment this is a genuine but moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis; the vendor has published a fix.
Server-side request forgery in SveltyCMS 0.0.6 lets an authenticated, low-privileged user (CVSS PR:L, confirmed in both the supplied CVSS 4.0 vector and the independent assessment) force the server to make outbound requests by supplying a crafted remote media/importer URL to the File Upload Endpoint at /mediagallery/upload-media. Exploitation requires valid credentials on a reachable instance that exercises remote media fetching, and the resulting impact is limited (low confidentiality, integrity, and availability, no scope change, no user interaction) - this is a real-but-modest issue rather than a top-priority one. No public exploit code was identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the vendor has published an upstream fix commit (05b4f9efeb79e9d72a693232334d7529687f896f) that replaces raw outbound fetches with validated egress helpers.
Server-side request forgery in OpenCVE versions prior to 3.0.0 lets an authenticated user who holds permission to configure notification channels force the OpenCVE server to issue HTTP or HTTPS requests to arbitrary attacker-chosen destinations, including localhost interfaces, RFC1918 internal ranges, link-local addresses and the cloud metadata endpoint 169.254.169.254, with the response content retrievable by the attacker. The prerequisite is the notification-configuration privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-918), so anonymous actors cannot trigger it, and the practical impact is highest in cloud-hosted deployments where an instance metadata service is reachable from the OpenCVE host; no public exploit code has been identified at time of analysis. The issue is fixed in OpenCVE 3.0.0.
Server-side request forgery in ArcadeDB versions before 26.9.1 allows an authenticated user to bypass the built-in SSRF guard by supplying hostnames that resolve to IPv6 transition addresses (NAT64, 6to4, or Teredo) which embed RFC 1918 or loopback IPv4 targets, causing IMPORT DATABASE and server commands to fetch internal-only resources on the attacker's behalf. Exploitation requires valid credentials and permission to invoke the URL-fetching command, and meaningful impact depends on reachable internal services - most notably a cloud instance metadata endpoint such as 169.254.169.254 - being network-accessible from the ArcadeDB host; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change and no availability impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the vendor advisory notes that patches are available, making this a medium-priority credentialed issue rather than an urgent one.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
Limited server-side request forgery in the Auto Upload Images WordPress plugin (all versions up to and including 3.3.2) lets an authenticated user with contributor-level access or higher make the affected site issue outbound web requests to arbitrary destinations. The plugin's downloadImage routine uses wp_remote_get() instead of wp_safe_remote_get(), and its validate() method only rejects URLs whose host matches the site's own hostname, so requests to loopback, private, and link-local targets such as 127.0.0.1, 10.0.0.0/8, or 169.254.169.254 are not blocked. Exploitation is triggered simply by embedding a crafted <img> tag in post content and submitting it for processing; no KEV entry, public exploit code, or other active-exploitation signal was identified at time of analysis, and the practical impact is bounded because the SSRF is a GET-based image fetch with low confidentiality impact and a contributor authentication prerequisite.
Unauthenticated server-side request forgery (SSRF) in the WordPress plugin 'Generate PDF using Contact Form 7' before version 4.2.2 lets remote attackers force the server to fetch an arbitrary URL - including internal-only resources - and read the fetched content back out of the generated PDF. Exploitation requires only that the site runs the vulnerable plugin and exposes a Contact Form 7 form whose submission triggers PDF generation; no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, assessed C:H versus the published C:L). A publicly available exploit exists (WPScan), and a vendor fix is available in 4.2.2, so upgrading is the decisive action.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Server-side request forgery in the Omnibox of Google Chrome on Android prior to 153.0.8010.52 allows an unauthenticated remote attacker to bypass system access restrictions by combining social engineering with crafted network traffic, producing only a limited integrity impact (CVSS 3.7, AC:H, C:N/I:L/A:N) with no confidentiality or availability loss and no code execution. The bug is Android-scoped, rated Medium by Chromium, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'. In short, this is a low-priority, low-real-risk issue despite being a network-vector SSRF in a ubiquitous browser.
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Path traversal in SmallRye JWT's AwsAlbKeyResolver lets an unauthenticated remote attacker force the application server to issue GET requests to arbitrary paths on the same origin as the configured AWS ALB key endpoint, because the attacker-controlled 'kid' header is concatenated into the key-fetch URL without sanitizing path traversal characters or query-string separators. Only applications that explicitly enable the non-default AWS_ALB key provider (used to verify JWTs signed by AWS Application Load Balancers) are affected; installations using other key resolvers are unaffected. The impact is confidentiality-only and limited to non-public endpoints or internal data reachable on that same origin, since the rogue request fires before JWT signature verification. No public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied; Red Hat (secalert@redhat.com) tracks the issue as a moderate-severity path traversal.
Server-side request forgery in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3 allows an authenticated low-privileged user to make the management server issue attacker-influenced outbound requests on their behalf. Dell rates the issue CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a network-reachable flaw that requires a valid low-privileged session but no user interaction, with the scope change indicating impact can extend to resources beyond the OMSA component itself. Only managed-node builds on Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 below 11.1.0.3 are affected, and no public exploit identified at time of analysis. Because the flaw is reachable from the network but gated behind authentication, exploitation is most plausible from an already-compromised low-privileged account or an insider on a segment that can reach the OMSA console.
Server-side request forgery in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 allows an authenticated attacker holding at least the Contributor role to make the affected site's web server issue outbound HTTP requests to attacker-chosen destinations, with no user interaction required. The practical barrier is the Contributor authentication requirement (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4), which limits realistic exposure to insider abuse, sites that permit open Contributor registration, or a chained credential-compromise scenario rather than anonymous mass exploitation. No public exploit code has been identified and the vulnerability is not confirmed actively exploited (CISA KEV); this should be triaged as a medium-priority, authentication-gated SSRF and not as a top-tier emergency.
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.
Arbitrary local file read and server-side request forgery are possible in the Nodemailer npm package through version 9.1.0 when an application that has deliberately enabled the disableFileAccess/disableUrlAccess sandbox resolves untrusted message content through the legacy three-argument API MailMessage.resolveContent(data, key, callback). Because the omitted options argument is normalized to an empty object inside shared.resolveContent(), the message-level sandbox flags copied into mail.data by the MailMessage constructor are discarded and resolveContentValue() skips both access-control guards, reaching fs.createReadStream() for local files or nmfetch() for outbound HTTP(S) requests driven by attacker-controlled html, text, or attachment path/href values. The flaw is strongly condition-gated: it is inert unless the sandbox was enabled AND the legacy signature is used on attacker-controlled content, which is reflected in the high attack complexity and present-attacker scoring; the internal transporter.sendMail() resolution paths are unaffected, no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 9.1.1.
Server-side request forgery in Metabase through 0.63.18 lets an attacker bypass GeoJSON URL validation by saving a custom GeoJSON entry that points at the unspecified address 0.0.0.0, which resolves to loopback and causes the Metabase server to fetch from services bound to localhost and return their responses to the caller. Note a conflict in the source data: vendor scoring (CVSS 4.0 with PR:H) requires high-privileged, authenticated access to persist the malicious GeoJSON entry, while the CVE description asserts that the triggered read is returned to unauthenticated callers - the authentication bar for triggering and reading should be verified against the vendor advisory. Publicly available exploit code exists (VulnCheck advisory and a public write-up), there is no CISA KEV listing indicating confirmed active exploitation at time of analysis, and impact is confidentiality-only, since only response data is exposed with no integrity or availability effect.
Server-side request forgery in Chatwoot's Shopify OAuth integration allows an authenticated user to make the Chatwoot server issue attacker-influenced outbound HTTP requests through the OAuth callback handler in callbacks_controller.rb, affecting versions up to 4.17.1 (4.17.0 and 4.17.1 confirmed). The CVSS 4.0 vector carries PR:L, so a valid Chatwoot account is required, and the assessed impact is low (limited confidentiality effect with no scope change), consistent with a constrained or blind SSRF rather than arbitrary internal data retrieval. Publicly available exploit code exists and the issue was reported to the project without a vendor response, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall risk is low-priority.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Server-side request forgery in LiteLLM Proxy versions prior to 1.83.9 lets an authenticated caller holding a valid virtual key redirect the gateway's outbound LLM traffic to an internal or external host of their choosing by placing api_base (or base_url) inside the user_config object of the request body instead of at the top level. Because is_request_body_safe in pre-1.83.9 only banned those keys at the top level and never inspected user_config, and because user_config feeds outbound router construction, the nested destination survives the safety check and reaches endpoints the caller could not otherwise access. The result is blind SSRF with low confidentiality impact against the proxy's network context rather than data theft or code execution; exploitation requires a working virtual key (PR:L, no user interaction), and no public exploit code has been identified at time of analysis.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.
Server-side request forgery in Hippo4j through 1.5.0 allows an authenticated user of the Hippo4j server console to force the application to issue outbound HTTP GET requests to arbitrary hostnames and ports, because four ThreadPoolController endpoints accept a clientAddress parameter without validation. Affected deployments are those running the Hippo4j console with reachable internal services or cloud metadata endpoints (for example 169.254.169.254); the CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact gated behind a valid console session (PR:L) with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact against cloud environments depends on whether the instance exposes a metadata service and on whether the affected endpoints return the fetched response body, which is not confirmed by the available source data.
Server-side request forgery in MLRun through 1.11.0 lets an authenticated user who can create or update a run attach a malicious WebhookNotification that makes the API server issue arbitrary outbound HTTP requests once that run transitions to a terminal state. Because the request originates from inside the cluster, it can be aimed at internal services, the in-cluster Kubernetes API, or cloud metadata endpoints such as 169.254.169.254, although the SSRF is blind/semi-blind and practical impact depends on egress filtering and metadata access in the target deployment. Rated 5.3 (CVSS:4.0) with low confidentiality and integrity impact and no availability impact; no public exploit identified at time of analysis.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
Server-side request forgery in the Jenkins Bitbucket Push and Pull Request Plugin (4.0.1 and earlier) lets remote attackers submit a crafted webhook payload whose attacker-controlled URL Jenkins then contacts using the Bitbucket credentials stored in the plugin's configuration, exposing those credentials. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) the attack is remote, low-complexity, and requires no authentication or user interaction; our independent assessment rates the confidentiality impact as high because successful exploitation yields the stored Bitbucket credential material itself. Exploitation is only possible on Jenkins instances where the plugin is installed, reachable on its webhook trigger endpoint, and actually configured with Bitbucket credentials; no public exploit code has been identified at time of analysis and there is no KEV listing for this CVE.
Server-side request forgery in the WP Import Export Lite WordPress plugin (versions before 3.9.33) allows an authenticated user holding the plugin's 'import' capability - which administrators hold by default but which can be delegated to lower-privileged roles - to make the WordPress site request arbitrary URLs and return the fetched response content back through the import workflow. Because the plugin fails to validate the import source URL, an attacker can point it at loopback addresses, internal hosts, or cloud metadata endpoints and use the site as a proxy to read services that are not otherwise reachable from outside the network; exploitation is read-only (no write or code execution) and its value depends on what internal services the web server can reach. Publicly available exploit code exists for this issue, though it is not confirmed as actively exploited, and EPSS rates the likelihood of exploitation very low (0.17%, 7th percentile). The fix is incomplete relative to CVE-2026-11397: sites patched only to the earlier release remain exposed until version 3.9.33 is installed.
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Server-side request forgery in the AWS Strands Python integration of ag-ui (ag_ui_strands) 0.3.0 allows a user who can submit a chat message to make the agent backend fetch an arbitrary URL through urllib.request.urlopen, reaching loopback, RFC1918, link-local and cloud metadata addresses from the server's network position. The flaw lives in the multimodal content path, where image, document or video attachments can be supplied as URLs rather than inline data, and the pre-patch code applied no scheme, host or redirect validation. Impact is bounded rather than devastating (CVSS 4.0 base 5.3, PR:L), and no public exploit code or CISA KEV entry was identified at time of analysis; the upstream fix commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 is public and referenced by issue #2432 and pull request #2491.
Server-side request forgery in Zenith Satellite Tracker 1.0 allows an unauthenticated remote attacker to force the web server to issue arbitrary HTTP and HTTPS requests via the 'address' parameter handled in sat_proxy.php, which is passed to curl without any scheme or host validation. Because the request originates from the server, an attacker can reach internal services or cloud metadata endpoints (for example 169.254.169.254) that are not directly exposed, potentially disclosing credentials, configuration data, or a foothold for further pivoting. The CVE is unauthenticated and remotely reachable per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and no public exploit code has been identified at time of analysis, so risk is driven primarily by how widely this niche product is deployed and whether Internal endpoints or instance metadata are reachable from the host running sat_proxy.php.
Server-side request forgery in Concrete CMS 9.0.0 through 9.5.2 allows an authenticated user who holds file-import privileges to make the server fetch internal-only resources by abusing a DNS pin that is validated once per host and then reused for every later URL on that host. Because the pinned validation and the unpinned download can resolve to different addresses, a rebinding host can redirect the request to loopback services, internal admin panels, or cloud metadata endpoints, with responses saved into the file manager. The vendor rates this only CVSS 4.0 base 2.1 given the high complexity and privileged prerequisite; no public exploit code or CISA KEV entry was identified at time of analysis.
Server-side request forgery in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier lets a low-privileged authenticated user submit a crafted connection definition for datacenter discovery and cause the server to make outbound requests to internal or cloud-metadata endpoints, with the potential to retrieve other users' credentials. Exploitation is remote (AV:N), requires no user interaction (UI:N), and needs only a valid low-privileged account (PR:L) plus the VMware sync/datacenter discovery feature; the practical impact depends on the server's network position, especially whether a cloud metadata service is reachable. There is no confirmed active exploitation and no public exploit identified at time of analysis, and the vendor EPSS score is low at 0.14% (4th percentile).
Server-side request forgery in the Fabric.js `loadFromJSON` method lets an attacker who can supply canvas JSON to a server-side Fabric.js implementation coerce the host into fetching arbitrary URIs, including internal network resources. The flaw is a missing URI validation step (CWE-918) that is triggered only when the library is used to render or parse untrusted JSON in a server context; browser-only usage of the canvas library is not exposed. ZDI rates it CVSS 4.0 (AV:L/AC:H), no public exploit code has been identified at time of analysis, and the library is not listed in CISA KEV; EPSS data was not available in the supplied intelligence.
AVideo through 29.0 is affected by a blind server-side request forgery (SSRF) in the getHeaderContentTypeFromURL function, which performs get_headers() calls on URL values that are only checked for format rather than destination. An authenticated user holding the canUpload permission can persist an attacker-chosen URL as a video link; the vulnerable lookup then fires on every render of that video's watch page, letting the attacker probe internal hosts and infer results through content-type differences and response timing. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied in the input, so real-world exploitation activity remains unconfirmed.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Server-side request forgery in Refly through version 1.1.0 allows authenticated users to coerce the backend into issuing HTTP requests to arbitrary internal addresses by supplying unvalidated URLs to the POST /v1/misc/scrape endpoint. The backend performs no scheme, hostname, or resolved-IP validation before fetching, enabling access to loopback services, RFC1918 private networks, and link-local cloud metadata services such as AWS IMDS at 169.254.169.254. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS data is not yet available for this CVE.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
Server-side request forgery in netease-youdao LobsterAI affects the `buildBrowserConfig` function within the Browser Network Configuration component, enabling remote attackers to manipulate the application into making forged outbound network requests to attacker-specified targets. Versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4 are confirmed affected per EUVD enumeration and NVD CPE wildcard coverage. A public proof-of-concept exploit is hosted on GitHub Gist; no vendor patch has been released, and the originating GitHub issue was closed automatically due to inactivity, suggesting no upstream remediation is forthcoming.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Server-side request forgery in the MCP Atlassian MCP server (versions 0.17.0 through 0.21.x) allows remote unauthenticated attackers to force the server to make outbound requests to internal addresses such as the cloud metadata endpoint 169.254.169.254. The flaw is an incomplete-fix TOCTOU: validate_url_for_ssrf resolves and approves the attacker-supplied X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url host once at middleware time, but the actual HTTP client re-resolves the raw hostname at connect time with no IP pinning, so a DNS-rebinding name can pass validation with a public IP and then resolve to a link-local or RFC1918 address. Exploitation is a documented, publicly described proof-of-concept rather than confirmed in-the-wild activity (no CISA KEV listing), and the vendor has released version 0.22.0 as the fix.
Server-side request forgery in cosmicstack-labs Mercury Agent (versions 1.1.0 through 1.1.13) lets an attacker who can influence the `path` argument of the GitHub API handler force the agent to issue requests to arbitrary hosts, including internal services reachable from the agent's network position. The flaw is in the githubRequest function of src/utils/github.ts (CWE-918), and publicly available exploit code exists — the reporter's tracking issue (#81) on the project repository is public. The maintainer was informed early through an issue report but has not responded, so no vendor-released fix is confirmed at time of analysis.
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Server-side request forgery in the Huly Platform print service (pod-print) through version 0.7.426 lets an authenticated workspace member hand an arbitrary URL to the print endpoint, which Puppeteer fetches and renders back as a downloadable PDF or image. Because no hostname allowlist is enforced, the headless browser can be steered at internal metadata services (e.g. cloud IMDS endpoints) and other network-internal hosts, turning the platform into an internal network proxy and credential-leak vector. No CISA KEV listing and no publicly available exploit code were identified at time of analysis, and CISA SSVC records exploitation as 'none' with automatable 'no'.
Let me synthesize the analysis for CVE-2026-90790, an SSRF in a2a-python's push notification sender. Key facts: - Product: a2a-python (A2A Python SDK by a2aproject) - Function: _dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py - Component: Push Notification Sender - Argument push_info.url → SSRF (CWE-918) - Remote exploitation possible - Affected: up to 1.1.3 (1.1.0, 1.1.1, 1.1.2, 1.1.3) - Fix: 1.1.4 (release tag v1.1.4, PRs 1164 and 1169) - CVSS 4.0: 5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Note PR:L — low privileges required. So authenticated in some sense. - EPSS: not provided - KEV: no - POC: "Reported by VulDB" — no explicit POC. The patch PRs are public, so the fix commit is public. But no explicit POC listed. I'll say "no public exploit identified at time of analysis". - Tags: Python, SSRF, A2A Python Patch: available from vendor, exact version 1.1.4. Interesting detail from diff: the library removed the built-in `push_url_validation_error` helper (SSRF screening) and made the validator opt-in, requiring the deployment to pass `push_url_validator` explicitly. Actually the diff shows the removal of `_ip_is_blocked` and `push_url_validation_error` from base_push_notification_sender.py, and adding a push_url_validator parameter that defaults to None (no library screening). Hmm — that's interesting: the fix in v1.1.4 removed the automatic SSRF screening and replaced it with opt-in validation via `validate_push_notification_url` in src/a2a/utils/push_url_validator.py. That's a bit odd — the fix may be reworked. Actually it looks like the "fix" makes the URL validation a shared utility and requires explicit opt-in. Hmm, this suggests the vulnerability was that the default screening wasn't applied in `_dispatch_notification` at all (the function didn't call the validator), so pushing to a malicious URL would trigger an outbound request to an arbitrary internal address. The PR adds the validator hook into `_dispat
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
Server-side request forgery in tarzan-cms 1.0.0 allows remote attackers to force the application server to initiate arbitrary outbound HTTP connections by manipulating the `httpUrl` argument passed to the `openConnection()` method in `ThemeService.java`. The Theme Download Function passes user-supplied URL input directly to a connection handler without adequate validation, enabling internal network reconnaissance, cloud metadata endpoint access, or pivoting to backend services. A proof-of-concept has been publicly disclosed via a Gitee issue report; no vendor patch exists and the project maintainer has not responded to the disclosure.
Server-side request forgery in FlowiseAI Flowise up to version 3.0.2 allows authenticated users to redirect internal server-side HTTP requests by supplying attacker-controlled Host and X-Forwarded-Proto headers to the Evaluations endpoint, causing the server to construct the axios.post base URL from untrusted input rather than a trusted server-side value. The flaw enables the Flowise server to be leveraged as a proxy for reaching internal network resources, cloud metadata services, or adjacent microservices invisible to the external attacker. A publicly available proof-of-concept exists (GitHub issue #6687), and vendor-released patch 3.1.3 is available, though all affected versions (≤3.0.2) have been designated end-of-life by the maintainer.
Server-side request forgery in OpenStatus's status-page proxy allows remote attackers to manipulate custom domain resolution, causing the application server to issue forged HTTP requests to unintended internal or external targets. The vulnerable code path in `resolve-custom-domain-rewrite.ts` used attacker-influenced hostname data during URL rewriting without validating that the resolved target corresponded to a legitimate page slug. The patch (commit 86f370c) introduces `applyPageSlugPrefix` to normalize custom domain prefixes to their corresponding page slugs before any internal URL composition occurs, closing the forgery path. No public exploit has been identified at time of analysis, and exploitation requires passive user interaction per the CVSS 4.0 vector.
Path-based server-side request forgery in an ICS inventory management platform allows authenticated low-privilege users to inject arbitrary path components into backend requests destined for an internal search and analytics data store. The application unwittingly proxies attacker-controlled paths using its own elevated service credentials, enabling enumeration and reading of internal configuration and administrative data from the backend that would otherwise be inaccessible. No public exploit or active exploitation has been identified; the ICS operational context reported by ICS-CERT elevates the consequence of internal configuration exposure.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to internal network services by exploiting an incomplete IPv6 blocklist in the host-validation layer. The HostCheck::ipAddressIsNotInternal() function strips ::ffff: IPv4-mapped prefixes but ignores three IPv6 transition address families - NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) - enabling an attacker who controls a domain with crafted AAAA records to also defeat the CURLOPT_RESOLVE IP-pinning guard and reach private infrastructure. A publicly available exploit has been confirmed by VulnCheck; no CISA KEV listing has been observed at time of analysis.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. No public exploit exists and the issue is not in CISA KEV, but the scope-changed CVSS vector (S:C) and potential exposure of cloud IAM credentials in hosted deployments elevate practical risk above the 5.0 base score.
WeasyPrint ≤v69.0 silently bypasses application-configured url_fetcher restrictions in two write_pdf() channels, enabling arbitrary local file read and SSRF in server-side PDF rendering pipelines. The xmp_metadata parameter fetches attacker-controlled URLs using the default unrestricted URLFetcher and embeds the response bytes verbatim in the generated PDF, while the stylesheets parameter applies fetched CSS with transitive propagation through @import chains - both ignoring any restrictive fetcher set on HTML(). No public exploit is listed in KEV, but the advisory includes complete working PoC code demonstrating credential file exfiltration.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
Unauthenticated SSRF in Yordam Informatics' Library Information and Document Automation Program allows remote attackers to induce the server to issue arbitrary HTTP requests to internal or external destinations. Affecting all versions before v22.2, the flaw is reachable without credentials over the network, giving attackers a pivot point to probe internal network resources, cloud metadata endpoints, or other services inaccessible from the public internet. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the `avro.schema.url` table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. Reported by zhaokaifei of ChinaTelecom, the vulnerability is resolved in version 4.5.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in opengeos GeoLibre up to version 2.3.0 allows malicious plugins or attacker-controlled WebView content to invoke the application's native Tauri IPC commands (`fetch_url_bytes`, `resolve_url_redirect`) to issue HTTP requests from the desktop process's privileged network position, bypassing browser CORS restrictions and potentially reaching cloud instance-metadata services (169.254.169.254) inaccessible to ordinary browser fetch. The vulnerability is fixed in GeoLibre 2.4.0 via commit b745f62e29fa37364686525a21eee5e5c0f8a369. No public exploit code is identified at time of analysis and no CISA KEV active-exploitation listing exists.
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Snipe-IT before 8.7.0 allows a super-admin to bypass the ExternalUrl webhook SSRF guard by supplying IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. The validation logic only checks IPv4 address representations, so transition-encoded addresses such as 64:ff9b::169.254.169.254 pass unchallenged, enabling the server to reach internal services or cloud metadata endpoints like the AWS IMDSv1 API. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is version 8.7.0.
Server-Side Request Forgery in ONLYOFFICE ownCloud Integration Plugin version 9.12 enables an authenticated administrator to redirect outbound HTTP requests from the ownCloud server to arbitrary internal destinations by supplying a malicious Document Server URL to the `/apps/onlyoffice/ajax/settings/address` endpoint. Successful exploitation allows internal network reconnaissance and TCP port scanning through differential server response timing and content. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), reflecting low observed exploitation interest despite the high confidentiality impact rating.
Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound HTTP requests to arbitrary caller-supplied destinations via the POST /api/embedding-models/test endpoint. The application leaks network reachability information through transport-layer error messages, allowing attackers to enumerate internal hosts, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and adjacent services. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score is 6.9 (Medium), reflecting real but bounded impact.
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and the associated DNS resolution to route the server's outbound CIMD metadata fetches to loopback, link-local, or internal addresses. The `public_ip?/1` guard in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` failed to classify three IPv6 address families as private - IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10 - so a crafted DNS AAAA response in any of these ranges bypassed the policy. No public exploit has been identified at time of analysis; vendor patch released in version 0.3.1.
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a locally authenticated low-privileged attacker to conduct server-side request forgery, resulting in high confidentiality impact with no integrity or availability loss. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in routine patch-cycle priority rather than emergency response.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Server-side request forgery in openagents up to 0.8.19 and 0.9.3.post20 allows unauthenticated remote attackers to manipulate the base_url argument of the test_default_model function in sdk/src/openagents/sdk/transports/http.py, causing the server to issue arbitrary outbound HTTP requests and disclose internal network responses. The vulnerability was publicly disclosed via GitHub issue #566 with a proof-of-concept. Critically, the maintainer closed the issue as inapplicable despite the identical unguarded code shipping in 0.9.3.post20 - the endpoint and both code sinks remain unchanged; only the file path was relocated in commit e277dd1a.
Server-side request forgery in Rowboat through 0.9.1 allows any authenticated user to redirect the application server's outbound HTTP client at arbitrary destinations, including cloud instance-metadata endpoints and RFC 1918 internal services, by supplying unvalidated URLs when registering custom MCP servers or webhooks. The missing URL validation exists in two confirmed code paths - the add-custom-mcp-server use-case and agent-tools runtime - as documented in VulnCheck's advisory and GitHub issue #621. No vendor-released patch version is identified in available references, and no public exploit code or CISA KEV listing exists at time of analysis.
Confused deputy SSRF bypass in Sim before 0.8.14 allows authenticated workflow authors to reach internal-only API endpoints by exploiting URL prefix matching without scheme normalization. When an HTTP block in a workflow specifies a path beginning with /api/, the routing layer misclassifies the request as internal, skips SSRF validation, and mints an internal authentication token - granting the attacker access to endpoints such as POST /api/function/execute that are meant to be restricted to the server itself. No public exploit is confirmed at time of analysis, but a researcher disclosure writeup is available on GitHub, and a fix was shipped in PR #7179 targeting v0.8.14.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to leverage the application server as a proxy to reach internal network resources, exposing sensitive information from systems not directly accessible to the attacker. The CVSS S:C scope-change metric signals that the primary risk extends beyond the vulnerable component itself - cloud-hosted instances are particularly exposed to metadata-service credential theft via endpoints like AWS IMDSv1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-side request forgery in Marqo ≤ 2.26.0 allows unauthenticated remote attackers to force the server to issue HTTP requests to arbitrary internal or external URLs by supplying attacker-controlled values in media fields of the add_documents API endpoint. The vulnerability originates in the inference orchestrator's image download component - specifically the download_image_from_url and fetch_content_sample functions in image_download.py - which perform no host validation or destination filtering before fetching user-supplied URLs. In cloud-hosted deployments, this enables access to instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) that can yield IAM role credentials, substantially amplifying the practical impact beyond the moderate CVSS 4.0 base score of 6.9. No public exploit code has been identified and the vulnerability is not in the CISA KEV catalog.
Server-side request forgery in Trigger.dev before 4.5.2 allows authenticated organization members to register webhook alert channel URLs targeting internal network services, loopback addresses, or cloud provider metadata endpoints such as the AWS IMDSv1 service. When an alert is delivered, the Trigger.dev server issues an outbound POST request to the attacker-controlled URL without any URL validation or SSRF filtering, exposing internal infrastructure to probing and potentially yielding cloud IAM credentials. The vendor released v4.5.2 as a security hardening release that introduces URL sanitization via a `sanitizeHttpUrl` utility; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.
Server-side request forgery in the IBM i FTP server (releases 7.3, 7.4, 7.5, and 7.6) lets an authenticated FTP user bypass security restrictions and pivot to internal network services by supplying crafted PORT and EPRT commands. The flaw is an improper-validation issue (CWE-918) with a scope change because the FTP component directs connections to services outside its own security boundary; scoring is CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation requires valid FTP credentials and network reachability of the FTP service, and impact is limited to confidentiality and integrity of whatever internal services the IBM i host can reach. Per the independent assessment this is a genuine but moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis; the vendor has published a fix.
Server-side request forgery in SveltyCMS 0.0.6 lets an authenticated, low-privileged user (CVSS PR:L, confirmed in both the supplied CVSS 4.0 vector and the independent assessment) force the server to make outbound requests by supplying a crafted remote media/importer URL to the File Upload Endpoint at /mediagallery/upload-media. Exploitation requires valid credentials on a reachable instance that exercises remote media fetching, and the resulting impact is limited (low confidentiality, integrity, and availability, no scope change, no user interaction) - this is a real-but-modest issue rather than a top-priority one. No public exploit code was identified at time of analysis, the flaw is not confirmed actively exploited (CISA KEV), and the vendor has published an upstream fix commit (05b4f9efeb79e9d72a693232334d7529687f896f) that replaces raw outbound fetches with validated egress helpers.
Server-side request forgery in OpenCVE versions prior to 3.0.0 lets an authenticated user who holds permission to configure notification channels force the OpenCVE server to issue HTTP or HTTPS requests to arbitrary attacker-chosen destinations, including localhost interfaces, RFC1918 internal ranges, link-local addresses and the cloud metadata endpoint 169.254.169.254, with the response content retrievable by the attacker. The prerequisite is the notification-configuration privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-918), so anonymous actors cannot trigger it, and the practical impact is highest in cloud-hosted deployments where an instance metadata service is reachable from the OpenCVE host; no public exploit code has been identified at time of analysis. The issue is fixed in OpenCVE 3.0.0.
Server-side request forgery in ArcadeDB versions before 26.9.1 allows an authenticated user to bypass the built-in SSRF guard by supplying hostnames that resolve to IPv6 transition addresses (NAT64, 6to4, or Teredo) which embed RFC 1918 or loopback IPv4 targets, causing IMPORT DATABASE and server commands to fetch internal-only resources on the attacker's behalf. Exploitation requires valid credentials and permission to invoke the URL-fetching command, and meaningful impact depends on reachable internal services - most notably a cloud instance metadata endpoint such as 169.254.169.254 - being network-accessible from the ArcadeDB host; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change and no availability impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the vendor advisory notes that patches are available, making this a medium-priority credentialed issue rather than an urgent one.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
Limited server-side request forgery in the Auto Upload Images WordPress plugin (all versions up to and including 3.3.2) lets an authenticated user with contributor-level access or higher make the affected site issue outbound web requests to arbitrary destinations. The plugin's downloadImage routine uses wp_remote_get() instead of wp_safe_remote_get(), and its validate() method only rejects URLs whose host matches the site's own hostname, so requests to loopback, private, and link-local targets such as 127.0.0.1, 10.0.0.0/8, or 169.254.169.254 are not blocked. Exploitation is triggered simply by embedding a crafted <img> tag in post content and submitting it for processing; no KEV entry, public exploit code, or other active-exploitation signal was identified at time of analysis, and the practical impact is bounded because the SSRF is a GET-based image fetch with low confidentiality impact and a contributor authentication prerequisite.
Unauthenticated server-side request forgery (SSRF) in the WordPress plugin 'Generate PDF using Contact Form 7' before version 4.2.2 lets remote attackers force the server to fetch an arbitrary URL - including internal-only resources - and read the fetched content back out of the generated PDF. Exploitation requires only that the site runs the vulnerable plugin and exposes a Contact Form 7 form whose submission triggers PDF generation; no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, assessed C:H versus the published C:L). A publicly available exploit exists (WPScan), and a vendor fix is available in 4.2.2, so upgrading is the decisive action.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Server-side request forgery in the Omnibox of Google Chrome on Android prior to 153.0.8010.52 allows an unauthenticated remote attacker to bypass system access restrictions by combining social engineering with crafted network traffic, producing only a limited integrity impact (CVSS 3.7, AC:H, C:N/I:L/A:N) with no confidentiality or availability loss and no code execution. The bug is Android-scoped, rated Medium by Chromium, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'. In short, this is a low-priority, low-real-risk issue despite being a network-vector SSRF in a ubiquitous browser.
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Path traversal in SmallRye JWT's AwsAlbKeyResolver lets an unauthenticated remote attacker force the application server to issue GET requests to arbitrary paths on the same origin as the configured AWS ALB key endpoint, because the attacker-controlled 'kid' header is concatenated into the key-fetch URL without sanitizing path traversal characters or query-string separators. Only applications that explicitly enable the non-default AWS_ALB key provider (used to verify JWTs signed by AWS Application Load Balancers) are affected; installations using other key resolvers are unaffected. The impact is confidentiality-only and limited to non-public endpoints or internal data reachable on that same origin, since the rogue request fires before JWT signature verification. No public exploit code or active exploitation was identified at time of analysis, and no EPSS score was supplied; Red Hat (secalert@redhat.com) tracks the issue as a moderate-severity path traversal.
Server-side request forgery in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3 allows an authenticated low-privileged user to make the management server issue attacker-influenced outbound requests on their behalf. Dell rates the issue CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a network-reachable flaw that requires a valid low-privileged session but no user interaction, with the scope change indicating impact can extend to resources beyond the OMSA component itself. Only managed-node builds on Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 below 11.1.0.3 are affected, and no public exploit identified at time of analysis. Because the flaw is reachable from the network but gated behind authentication, exploitation is most plausible from an already-compromised low-privileged account or an insider on a segment that can reach the OMSA console.
Server-side request forgery in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) through version 2.0.19 allows an authenticated attacker holding at least the Contributor role to make the affected site's web server issue outbound HTTP requests to attacker-chosen destinations, with no user interaction required. The practical barrier is the Contributor authentication requirement (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4), which limits realistic exposure to insider abuse, sites that permit open Contributor registration, or a chained credential-compromise scenario rather than anonymous mass exploitation. No public exploit code has been identified and the vulnerability is not confirmed actively exploited (CISA KEV); this should be triaged as a medium-priority, authentication-gated SSRF and not as a top-tier emergency.
Server-side request forgery in the MISP sachertortephp library (a fork of CakePHP) lets any code that calls Xml::build() with the readFile option set to false still trigger an outbound HTTPS fetch whenever the supplied input string starts with 'https://', because a missing pair of parentheses in the gating condition makes the https:// branch independent of the readFile flag. The application then parses the remote response as XML and may hand it back to the caller, exposing internal-only services or attacker-chosen external endpoints to data disclosure, with the bundled HttpSocket configuration following up to 10 redirects to widen reachable targets. Exploitation is authenticated in practice (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L) and requires a reachable host-application code path that passes attacker-influenceable data to Xml::build(); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The http:// branch is correctly gated and is not exploitable - only the https:// scheme bypasses the intended suppression of remote reads.
Arbitrary local file read and server-side request forgery are possible in the Nodemailer npm package through version 9.1.0 when an application that has deliberately enabled the disableFileAccess/disableUrlAccess sandbox resolves untrusted message content through the legacy three-argument API MailMessage.resolveContent(data, key, callback). Because the omitted options argument is normalized to an empty object inside shared.resolveContent(), the message-level sandbox flags copied into mail.data by the MailMessage constructor are discarded and resolveContentValue() skips both access-control guards, reaching fs.createReadStream() for local files or nmfetch() for outbound HTTP(S) requests driven by attacker-controlled html, text, or attachment path/href values. The flaw is strongly condition-gated: it is inert unless the sandbox was enabled AND the legacy signature is used on attacker-controlled content, which is reflected in the high attack complexity and present-attacker scoring; the internal transporter.sendMail() resolution paths are unaffected, no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 9.1.1.
Server-side request forgery in Metabase through 0.63.18 lets an attacker bypass GeoJSON URL validation by saving a custom GeoJSON entry that points at the unspecified address 0.0.0.0, which resolves to loopback and causes the Metabase server to fetch from services bound to localhost and return their responses to the caller. Note a conflict in the source data: vendor scoring (CVSS 4.0 with PR:H) requires high-privileged, authenticated access to persist the malicious GeoJSON entry, while the CVE description asserts that the triggered read is returned to unauthenticated callers - the authentication bar for triggering and reading should be verified against the vendor advisory. Publicly available exploit code exists (VulnCheck advisory and a public write-up), there is no CISA KEV listing indicating confirmed active exploitation at time of analysis, and impact is confidentiality-only, since only response data is exposed with no integrity or availability effect.
Server-side request forgery in Chatwoot's Shopify OAuth integration allows an authenticated user to make the Chatwoot server issue attacker-influenced outbound HTTP requests through the OAuth callback handler in callbacks_controller.rb, affecting versions up to 4.17.1 (4.17.0 and 4.17.1 confirmed). The CVSS 4.0 vector carries PR:L, so a valid Chatwoot account is required, and the assessed impact is low (limited confidentiality effect with no scope change), consistent with a constrained or blind SSRF rather than arbitrary internal data retrieval. Publicly available exploit code exists and the issue was reported to the project without a vendor response, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall risk is low-priority.
An authenticated server-side request forgery (SSRF) in Tanium Threat Response allows a user who already holds valid console or module credentials to coerce the Tanium server into making requests to attacker-influenced URLs, potentially disclosing internal-only resources. The vendor scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which matches our independent assessment: remote reachability with low attack complexity, but the low-privilege authentication requirement is the main limiting factor and there is no user interaction needed. Impact is confined to confidentiality (high) with no integrity or availability effect and no scope change, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Server-side request forgery in LiteLLM Proxy versions prior to 1.83.9 lets an authenticated caller holding a valid virtual key redirect the gateway's outbound LLM traffic to an internal or external host of their choosing by placing api_base (or base_url) inside the user_config object of the request body instead of at the top level. Because is_request_body_safe in pre-1.83.9 only banned those keys at the top level and never inspected user_config, and because user_config feeds outbound router construction, the nested destination survives the safety check and reaches endpoints the caller could not otherwise access. The result is blind SSRF with low confidentiality impact against the proxy's network context rather than data theft or code execution; exploitation requires a working virtual key (PR:L, no user interaction), and no public exploit code has been identified at time of analysis.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.
Server-side request forgery in Hippo4j through 1.5.0 allows an authenticated user of the Hippo4j server console to force the application to issue outbound HTTP GET requests to arbitrary hostnames and ports, because four ThreadPoolController endpoints accept a clientAddress parameter without validation. Affected deployments are those running the Hippo4j console with reachable internal services or cloud metadata endpoints (for example 169.254.169.254); the CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact gated behind a valid console session (PR:L) with no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical impact against cloud environments depends on whether the instance exposes a metadata service and on whether the affected endpoints return the fetched response body, which is not confirmed by the available source data.
Server-side request forgery in MLRun through 1.11.0 lets an authenticated user who can create or update a run attach a malicious WebhookNotification that makes the API server issue arbitrary outbound HTTP requests once that run transitions to a terminal state. Because the request originates from inside the cluster, it can be aimed at internal services, the in-cluster Kubernetes API, or cloud metadata endpoints such as 169.254.169.254, although the SSRF is blind/semi-blind and practical impact depends on egress filtering and metadata access in the target deployment. Rated 5.3 (CVSS:4.0) with low confidentiality and integrity impact and no availability impact; no public exploit identified at time of analysis.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
Server-side request forgery in the Jenkins Bitbucket Push and Pull Request Plugin (4.0.1 and earlier) lets remote attackers submit a crafted webhook payload whose attacker-controlled URL Jenkins then contacts using the Bitbucket credentials stored in the plugin's configuration, exposing those credentials. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) the attack is remote, low-complexity, and requires no authentication or user interaction; our independent assessment rates the confidentiality impact as high because successful exploitation yields the stored Bitbucket credential material itself. Exploitation is only possible on Jenkins instances where the plugin is installed, reachable on its webhook trigger endpoint, and actually configured with Bitbucket credentials; no public exploit code has been identified at time of analysis and there is no KEV listing for this CVE.
Server-side request forgery in the WP Import Export Lite WordPress plugin (versions before 3.9.33) allows an authenticated user holding the plugin's 'import' capability - which administrators hold by default but which can be delegated to lower-privileged roles - to make the WordPress site request arbitrary URLs and return the fetched response content back through the import workflow. Because the plugin fails to validate the import source URL, an attacker can point it at loopback addresses, internal hosts, or cloud metadata endpoints and use the site as a proxy to read services that are not otherwise reachable from outside the network; exploitation is read-only (no write or code execution) and its value depends on what internal services the web server can reach. Publicly available exploit code exists for this issue, though it is not confirmed as actively exploited, and EPSS rates the likelihood of exploitation very low (0.17%, 7th percentile). The fix is incomplete relative to CVE-2026-11397: sites patched only to the earlier release remain exposed until version 3.9.33 is installed.
Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthenticated attacker to make the agent process issue attacker-influenced outbound HTTP requests via the httpx.get call in file_resolver.py, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the agent host. Exploitation requires that the deployment actually uses the FileResolver extension's HTTP path and that an attacker can supply or influence the file reference (file_id/URL) the agent resolves; the impact is bounded to server-initiated requests rather than code execution, and the affected product's deployment footprint is very small. Vendor patching is available as an upstream commit/PR, and no public exploit code was identified at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (CVSS 4.0 base 6.9).
Server-side request forgery in the AWS Strands Python integration of ag-ui (ag_ui_strands) 0.3.0 allows a user who can submit a chat message to make the agent backend fetch an arbitrary URL through urllib.request.urlopen, reaching loopback, RFC1918, link-local and cloud metadata addresses from the server's network position. The flaw lives in the multimodal content path, where image, document or video attachments can be supplied as URLs rather than inline data, and the pre-patch code applied no scheme, host or redirect validation. Impact is bounded rather than devastating (CVSS 4.0 base 5.3, PR:L), and no public exploit code or CISA KEV entry was identified at time of analysis; the upstream fix commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 is public and referenced by issue #2432 and pull request #2491.
Server-side request forgery in Zenith Satellite Tracker 1.0 allows an unauthenticated remote attacker to force the web server to issue arbitrary HTTP and HTTPS requests via the 'address' parameter handled in sat_proxy.php, which is passed to curl without any scheme or host validation. Because the request originates from the server, an attacker can reach internal services or cloud metadata endpoints (for example 169.254.169.254) that are not directly exposed, potentially disclosing credentials, configuration data, or a foothold for further pivoting. The CVE is unauthenticated and remotely reachable per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and no public exploit code has been identified at time of analysis, so risk is driven primarily by how widely this niche product is deployed and whether Internal endpoints or instance metadata are reachable from the host running sat_proxy.php.
Server-side request forgery in Concrete CMS 9.0.0 through 9.5.2 allows an authenticated user who holds file-import privileges to make the server fetch internal-only resources by abusing a DNS pin that is validated once per host and then reused for every later URL on that host. Because the pinned validation and the unpinned download can resolve to different addresses, a rebinding host can redirect the request to loopback services, internal admin panels, or cloud metadata endpoints, with responses saved into the file manager. The vendor rates this only CVSS 4.0 base 2.1 given the high complexity and privileged prerequisite; no public exploit code or CISA KEV entry was identified at time of analysis.
Server-side request forgery in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier lets a low-privileged authenticated user submit a crafted connection definition for datacenter discovery and cause the server to make outbound requests to internal or cloud-metadata endpoints, with the potential to retrieve other users' credentials. Exploitation is remote (AV:N), requires no user interaction (UI:N), and needs only a valid low-privileged account (PR:L) plus the VMware sync/datacenter discovery feature; the practical impact depends on the server's network position, especially whether a cloud metadata service is reachable. There is no confirmed active exploitation and no public exploit identified at time of analysis, and the vendor EPSS score is low at 0.14% (4th percentile).
Server-side request forgery in the Fabric.js `loadFromJSON` method lets an attacker who can supply canvas JSON to a server-side Fabric.js implementation coerce the host into fetching arbitrary URIs, including internal network resources. The flaw is a missing URI validation step (CWE-918) that is triggered only when the library is used to render or parse untrusted JSON in a server context; browser-only usage of the canvas library is not exposed. ZDI rates it CVSS 4.0 (AV:L/AC:H), no public exploit code has been identified at time of analysis, and the library is not listed in CISA KEV; EPSS data was not available in the supplied intelligence.
AVideo through 29.0 is affected by a blind server-side request forgery (SSRF) in the getHeaderContentTypeFromURL function, which performs get_headers() calls on URL values that are only checked for format rather than destination. An authenticated user holding the canUpload permission can persist an attacker-chosen URL as a video link; the vulnerable lookup then fires on every render of that video's watch page, letting the attacker probe internal hosts and infer results through content-type differences and response timing. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and no EPSS score was supplied in the input, so real-world exploitation activity remains unconfirmed.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Server-side request forgery in Refly through version 1.1.0 allows authenticated users to coerce the backend into issuing HTTP requests to arbitrary internal addresses by supplying unvalidated URLs to the POST /v1/misc/scrape endpoint. The backend performs no scheme, hostname, or resolved-IP validation before fetching, enabling access to loopback services, RFC1918 private networks, and link-local cloud metadata services such as AWS IMDS at 169.254.169.254. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS data is not yet available for this CVE.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
Server-side request forgery in netease-youdao LobsterAI affects the `buildBrowserConfig` function within the Browser Network Configuration component, enabling remote attackers to manipulate the application into making forged outbound network requests to attacker-specified targets. Versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4 are confirmed affected per EUVD enumeration and NVD CPE wildcard coverage. A public proof-of-concept exploit is hosted on GitHub Gist; no vendor patch has been released, and the originating GitHub issue was closed automatically due to inactivity, suggesting no upstream remediation is forthcoming.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Server-side request forgery in the MCP Atlassian MCP server (versions 0.17.0 through 0.21.x) allows remote unauthenticated attackers to force the server to make outbound requests to internal addresses such as the cloud metadata endpoint 169.254.169.254. The flaw is an incomplete-fix TOCTOU: validate_url_for_ssrf resolves and approves the attacker-supplied X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url host once at middleware time, but the actual HTTP client re-resolves the raw hostname at connect time with no IP pinning, so a DNS-rebinding name can pass validation with a public IP and then resolve to a link-local or RFC1918 address. Exploitation is a documented, publicly described proof-of-concept rather than confirmed in-the-wild activity (no CISA KEV listing), and the vendor has released version 0.22.0 as the fix.
Server-side request forgery in cosmicstack-labs Mercury Agent (versions 1.1.0 through 1.1.13) lets an attacker who can influence the `path` argument of the GitHub API handler force the agent to issue requests to arbitrary hosts, including internal services reachable from the agent's network position. The flaw is in the githubRequest function of src/utils/github.ts (CWE-918), and publicly available exploit code exists — the reporter's tracking issue (#81) on the project repository is public. The maintainer was informed early through an issue report but has not responded, so no vendor-released fix is confirmed at time of analysis.
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Server-side request forgery in the Huly Platform print service (pod-print) through version 0.7.426 lets an authenticated workspace member hand an arbitrary URL to the print endpoint, which Puppeteer fetches and renders back as a downloadable PDF or image. Because no hostname allowlist is enforced, the headless browser can be steered at internal metadata services (e.g. cloud IMDS endpoints) and other network-internal hosts, turning the platform into an internal network proxy and credential-leak vector. No CISA KEV listing and no publicly available exploit code were identified at time of analysis, and CISA SSVC records exploitation as 'none' with automatable 'no'.
Let me synthesize the analysis for CVE-2026-90790, an SSRF in a2a-python's push notification sender. Key facts: - Product: a2a-python (A2A Python SDK by a2aproject) - Function: _dispatch_notification in src/a2a/server/tasks/base_push_notification_sender.py - Component: Push Notification Sender - Argument push_info.url → SSRF (CWE-918) - Remote exploitation possible - Affected: up to 1.1.3 (1.1.0, 1.1.1, 1.1.2, 1.1.3) - Fix: 1.1.4 (release tag v1.1.4, PRs 1164 and 1169) - CVSS 4.0: 5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Note PR:L — low privileges required. So authenticated in some sense. - EPSS: not provided - KEV: no - POC: "Reported by VulDB" — no explicit POC. The patch PRs are public, so the fix commit is public. But no explicit POC listed. I'll say "no public exploit identified at time of analysis". - Tags: Python, SSRF, A2A Python Patch: available from vendor, exact version 1.1.4. Interesting detail from diff: the library removed the built-in `push_url_validation_error` helper (SSRF screening) and made the validator opt-in, requiring the deployment to pass `push_url_validator` explicitly. Actually the diff shows the removal of `_ip_is_blocked` and `push_url_validation_error` from base_push_notification_sender.py, and adding a push_url_validator parameter that defaults to None (no library screening). Hmm — that's interesting: the fix in v1.1.4 removed the automatic SSRF screening and replaced it with opt-in validation via `validate_push_notification_url` in src/a2a/utils/push_url_validator.py. That's a bit odd — the fix may be reworked. Actually it looks like the "fix" makes the URL validation a shared utility and requires explicit opt-in. Hmm, this suggests the vulnerability was that the default screening wasn't applied in `_dispatch_notification` at all (the function didn't call the validator), so pushing to a malicious URL would trigger an outbound request to an arbitrary internal address. The PR adds the validator hook into `_dispat
Server-side request forgery in PraisonAI's SpiderTools web-scraping component (praisonaiagents before 1.6.59) lets an attacker-supplied public URL pass the initial validation check and then redirect to loopback, private, link-local, or cloud metadata addresses, with the internal response body returned through scrape_page and its extract_links, crawl, and extract_text callers. Exploitation requires the agent to fetch an attacker-influenced URL, and a local-only proof of vulnerability was published in the vendor's GHSA advisory; there is no public exploit tooling and no evidence of active exploitation (not in CISA KEV, EPSS 0.26% / 17th percentile). The issue is fixed in praisonaiagents 1.6.59 (PraisonAI 4.6.59).
Server-side request forgery in tarzan-cms 1.0.0 allows remote attackers to force the application server to initiate arbitrary outbound HTTP connections by manipulating the `httpUrl` argument passed to the `openConnection()` method in `ThemeService.java`. The Theme Download Function passes user-supplied URL input directly to a connection handler without adequate validation, enabling internal network reconnaissance, cloud metadata endpoint access, or pivoting to backend services. A proof-of-concept has been publicly disclosed via a Gitee issue report; no vendor patch exists and the project maintainer has not responded to the disclosure.
Server-side request forgery in FlowiseAI Flowise up to version 3.0.2 allows authenticated users to redirect internal server-side HTTP requests by supplying attacker-controlled Host and X-Forwarded-Proto headers to the Evaluations endpoint, causing the server to construct the axios.post base URL from untrusted input rather than a trusted server-side value. The flaw enables the Flowise server to be leveraged as a proxy for reaching internal network resources, cloud metadata services, or adjacent microservices invisible to the external attacker. A publicly available proof-of-concept exists (GitHub issue #6687), and vendor-released patch 3.1.3 is available, though all affected versions (≤3.0.2) have been designated end-of-life by the maintainer.
Server-side request forgery in OpenStatus's status-page proxy allows remote attackers to manipulate custom domain resolution, causing the application server to issue forged HTTP requests to unintended internal or external targets. The vulnerable code path in `resolve-custom-domain-rewrite.ts` used attacker-influenced hostname data during URL rewriting without validating that the resolved target corresponded to a legitimate page slug. The patch (commit 86f370c) introduces `applyPageSlugPrefix` to normalize custom domain prefixes to their corresponding page slugs before any internal URL composition occurs, closing the forgery path. No public exploit has been identified at time of analysis, and exploitation requires passive user interaction per the CVSS 4.0 vector.
Path-based server-side request forgery in an ICS inventory management platform allows authenticated low-privilege users to inject arbitrary path components into backend requests destined for an internal search and analytics data store. The application unwittingly proxies attacker-controlled paths using its own elevated service credentials, enabling enumeration and reading of internal configuration and administrative data from the backend that would otherwise be inaccessible. No public exploit or active exploitation has been identified; the ICS operational context reported by ICS-CERT elevates the consequence of internal configuration exposure.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to internal network services by exploiting an incomplete IPv6 blocklist in the host-validation layer. The HostCheck::ipAddressIsNotInternal() function strips ::ffff: IPv4-mapped prefixes but ignores three IPv6 transition address families - NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) - enabling an attacker who controls a domain with crafted AAAA records to also defeat the CURLOPT_RESOLVE IP-pinning guard and reach private infrastructure. A publicly available exploit has been confirmed by VulnCheck; no CISA KEV listing has been observed at time of analysis.
Server-side request forgery in OpenPanel's data importer allows authenticated organization members to probe internal network hosts, services, and cloud metadata endpoints. The flaw exists because `parseRemoteFile` in `packages/importer/src/providers/umami.ts` calls plain `fetch()` on a caller-supplied `config.fileUrl` validated only by Zod's `z.string().url()` format check, entirely bypassing the project's own SSRF guard at `apps/api/src/utils/safe-fetch.ts`; the shared `createFileImportConfig` factory exposes the same unguarded field. An additional access-control bug means even a default 'member' with no project_access rows can exploit this path, because `getProjectAccess` returns boolean `true` instead of a level object, causing the intended access-level check to be skipped. No patched release was available at time of publication, and no public exploit has been identified at time of analysis.
SSRF filter-bypass in Open WebUI 0.9.5-0.11.0 allows authenticated users to route server-side fetches to private networks, loopback addresses, and cloud metadata endpoints by exploiting unvalidated HTTP redirect destinations. When AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled, the platform applies WEB_FETCH_FILTER_LIST and private-address controls only to the initial request URL, not to redirect hops - allowing a crafted redirect chain to reach AWS IMDS, Azure platform channels, or internal services. No public exploit exists and the issue is not in CISA KEV, but the scope-changed CVSS vector (S:C) and potential exposure of cloud IAM credentials in hosted deployments elevate practical risk above the 5.0 base score.
WeasyPrint ≤v69.0 silently bypasses application-configured url_fetcher restrictions in two write_pdf() channels, enabling arbitrary local file read and SSRF in server-side PDF rendering pipelines. The xmp_metadata parameter fetches attacker-controlled URLs using the default unrestricted URLFetcher and embeds the response bytes verbatim in the generated PDF, while the stylesheets parameter applies fetched CSS with transitive propagation through @import chains - both ignoring any restrictive fetcher set on HTML(). No public exploit is listed in KEV, but the advisory includes complete working PoC code demonstrating credential file exfiltration.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
Unauthenticated SSRF in Yordam Informatics' Library Information and Document Automation Program allows remote attackers to induce the server to issue arbitrary HTTP requests to internal or external destinations. Affecting all versions before v22.2, the flaw is reachable without credentials over the network, giving attackers a pivot point to probe internal network resources, cloud metadata endpoints, or other services inaccessible from the public internet. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-side request forgery in Apache Impala 2.0.0 through 4.5.1 allows SQL-authenticated users to coerce the Impala daemon into issuing arbitrary HTTP or file-system GET requests by specifying a malicious URL in the `avro.schema.url` table property. Internal service responses reachable by Impala but not directly by the attacker are partially exposed through SQL parsing error messages, enabling internal network reconnaissance, cloud metadata enumeration, and local file disclosure. Reported by zhaokaifei of ChinaTelecom, the vulnerability is resolved in version 4.5.2; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in opengeos GeoLibre up to version 2.3.0 allows malicious plugins or attacker-controlled WebView content to invoke the application's native Tauri IPC commands (`fetch_url_bytes`, `resolve_url_redirect`) to issue HTTP requests from the desktop process's privileged network position, bypassing browser CORS restrictions and potentially reaching cloud instance-metadata services (169.254.169.254) inaccessible to ordinary browser fetch. The vulnerability is fixed in GeoLibre 2.4.0 via commit b745f62e29fa37364686525a21eee5e5c0f8a369. No public exploit code is identified at time of analysis and no CISA KEV active-exploitation listing exists.
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Snipe-IT before 8.7.0 allows a super-admin to bypass the ExternalUrl webhook SSRF guard by supplying IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. The validation logic only checks IPv4 address representations, so transition-encoded addresses such as 64:ff9b::169.254.169.254 pass unchallenged, enabling the server to reach internal services or cloud metadata endpoints like the AWS IMDSv1 API. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is version 8.7.0.
Server-Side Request Forgery in ONLYOFFICE ownCloud Integration Plugin version 9.12 enables an authenticated administrator to redirect outbound HTTP requests from the ownCloud server to arbitrary internal destinations by supplying a malicious Document Server URL to the `/apps/onlyoffice/ajax/settings/address` endpoint. Successful exploitation allows internal network reconnaissance and TCP port scanning through differential server response timing and content. No public exploit code has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), reflecting low observed exploitation interest despite the high confidentiality impact rating.
Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Server-side request forgery in Knowns ≤0.33.0 enables unauthenticated remote attackers to make the server issue outbound HTTP requests to arbitrary caller-supplied destinations via the POST /api/embedding-models/test endpoint. The application leaks network reachability information through transport-layer error messages, allowing attackers to enumerate internal hosts, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and adjacent services. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score is 6.9 (Medium), reflecting real but bounded impact.
SSRF in ash_authentication_oauth2_server 0.3.0 allows an attacker who controls both an OAuth2 client's metadata URL and the associated DNS resolution to route the server's outbound CIMD metadata fetches to loopback, link-local, or internal addresses. The `public_ip?/1` guard in `AshAuthentication.Oauth2Server.CIMD.ReqFetcher` failed to classify three IPv6 address families as private - IPv4-compatible ::/96 (e.g., ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10 - so a crafted DNS AAAA response in any of these ranges bypassed the policy. No public exploit has been identified at time of analysis; vendor patch released in version 0.3.1.
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a locally authenticated low-privileged attacker to conduct server-side request forgery, resulting in high confidentiality impact with no integrity or availability loss. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, as confirmed by Dell Security Advisory DSA-2026-382. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in routine patch-cycle priority rather than emergency response.
Server-side request forgery in jackson-coreutils 2.0 allows remote unauthenticated attackers to manipulate the server into issuing arbitrary outbound HTTP requests by supplying a crafted URL to the JsonLoader.fromURL function. The vulnerability originates from insufficient URL validation in the library's JSON loading component, enabling internal network probing, access to cloud metadata endpoints, or interaction with internal services not otherwise reachable. A public proof-of-concept exists via the project's GitHub issue tracker, and the maintainer has not responded to the disclosure; no patch is available at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Server-side request forgery in openagents up to 0.8.19 and 0.9.3.post20 allows unauthenticated remote attackers to manipulate the base_url argument of the test_default_model function in sdk/src/openagents/sdk/transports/http.py, causing the server to issue arbitrary outbound HTTP requests and disclose internal network responses. The vulnerability was publicly disclosed via GitHub issue #566 with a proof-of-concept. Critically, the maintainer closed the issue as inapplicable despite the identical unguarded code shipping in 0.9.3.post20 - the endpoint and both code sinks remain unchanged; only the file path was relocated in commit e277dd1a.
Server-side request forgery in Rowboat through 0.9.1 allows any authenticated user to redirect the application server's outbound HTTP client at arbitrary destinations, including cloud instance-metadata endpoints and RFC 1918 internal services, by supplying unvalidated URLs when registering custom MCP servers or webhooks. The missing URL validation exists in two confirmed code paths - the add-custom-mcp-server use-case and agent-tools runtime - as documented in VulnCheck's advisory and GitHub issue #621. No vendor-released patch version is identified in available references, and no public exploit code or CISA KEV listing exists at time of analysis.
Confused deputy SSRF bypass in Sim before 0.8.14 allows authenticated workflow authors to reach internal-only API endpoints by exploiting URL prefix matching without scheme normalization. When an HTTP block in a workflow specifies a path beginning with /api/, the routing layer misclassifies the request as internal, skips SSRF validation, and mints an internal authentication token - granting the attacker access to endpoints such as POST /api/function/execute that are meant to be restricted to the server itself. No public exploit is confirmed at time of analysis, but a researcher disclosure writeup is available on GitHub, and a fix was shipped in PR #7179 targeting v0.8.14.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. A publicly available exploit exists and was reported by WPScan; EPSS stands at 0.13% (3rd percentile), suggesting no widespread automated exploitation at time of analysis despite the public PoC.
Server-side request forgery in Camaleon CMS 2.7.5-2.9.1 allows authenticated users to abuse the media library's 'Upload from URL' feature to reach internal network services. The root cause is Ruby's OpenURI library transparently following HTTP redirects, so a URL that passes initial host validation can redirect to an internal address (cloud metadata endpoints, internal APIs) that the server then fetches and returns. Version 2.9.2 patches the issue with a redirect-blocking download helper; no public exploit or CISA KEV listing has been identified.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to leverage the application server as a proxy to reach internal network resources, exposing sensitive information from systems not directly accessible to the attacker. The CVSS S:C scope-change metric signals that the primary risk extends beyond the vulnerable component itself - cloud-hosted instances are particularly exposed to metadata-service credential theft via endpoints like AWS IMDSv1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Server-side request forgery in Marqo ≤ 2.26.0 allows unauthenticated remote attackers to force the server to issue HTTP requests to arbitrary internal or external URLs by supplying attacker-controlled values in media fields of the add_documents API endpoint. The vulnerability originates in the inference orchestrator's image download component - specifically the download_image_from_url and fetch_content_sample functions in image_download.py - which perform no host validation or destination filtering before fetching user-supplied URLs. In cloud-hosted deployments, this enables access to instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) that can yield IAM role credentials, substantially amplifying the practical impact beyond the moderate CVSS 4.0 base score of 6.9. No public exploit code has been identified and the vulnerability is not in the CISA KEV catalog.
Server-side request forgery in Trigger.dev before 4.5.2 allows authenticated organization members to register webhook alert channel URLs targeting internal network services, loopback addresses, or cloud provider metadata endpoints such as the AWS IMDSv1 service. When an alert is delivered, the Trigger.dev server issues an outbound POST request to the attacker-controlled URL without any URL validation or SSRF filtering, exposing internal infrastructure to probing and potentially yielding cloud IAM credentials. The vendor released v4.5.2 as a security hardening release that introduces URL sanitization via a `sanitizeHttpUrl` utility; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.