SSRF
Monthly
Server-side request forgery in SpringBlade v4.8.0 allows authenticated network attackers to scan internal resources by sending crafted GET requests to the /ureport/datasource/testConnection endpoint, enabling reconnaissance of non-routable or restricted-access network segments. The vulnerability affects confidentiality but requires valid authentication credentials to exploit.
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/{name}/upgrade-from-uri endpoint permits authenticated attackers to scan internal network resources and retrieve sensitive data via crafted GET requests, potentially enabling reconnaissance of internal infrastructure. The vulnerability requires valid authentication credentials but operates with low attack complexity, affecting the confidentiality of internal resources without requiring user interaction or administrative privileges.
Server-side request forgery (SSRF) in Halo v2.22.14's /themes/{name}/upgrade-from-uri endpoint allows authenticated attackers to scan internal network resources and services by submitting crafted GET requests, enabling reconnaissance of backend infrastructure without direct network access.
Server-side request forgery in Halo v2.22.14 /themes/-/install-from-uri endpoint allows authenticated attackers to scan internal resources and access sensitive network information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity and results in confidentiality impact through information disclosure of internal network topology and services.
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/-/install-from-uri endpoint enables authenticated attackers to scan internal resources and potentially access sensitive information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity over the network, exposing internal network topology and services to enumeration attacks.
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the `media_paths` argument of the `xhs_publish_content` MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
Server-Side Request Forgery in Dell Disk Library for Mainframe (DLm8700 and DLm2700, versions prior to 7.0.1.0) enables a low-privileged remote attacker to coerce the appliance into issuing server-side HTTP requests to arbitrary internal or external resources. The vulnerability is scored CVSS 4.3 Medium and carries an EPSS of 0.01% (1st percentile), reflecting negligible real-world exploitation probability. No public exploit code exists and CISA SSVC assessment confirms no active exploitation and non-automatable attack path.
Server-side request forgery in Xuxueli xxl-job 3.3.0-3.3.2 allows an authenticated admin-panel user to supply arbitrary URLs in the `addressList` parameter of the manual job trigger endpoint, causing the server to issue outbound HTTP requests to attacker-specified internal or external destinations. The vulnerability is publicly disclosed with exploit code available, but the project maintainer formally disputes its severity, asserting the trigger endpoint is protected by login and role-based access control, and rejected the fix PR. No patched release exists; EPSS at 0.04% and absence from CISA KEV indicate minimal observed in-the-wild exploitation.
Server-side request forgery bypass in OpenClaw (npm) before 2026.4.8 allows authenticated users to reach private internal network targets by exploiting a race condition in Playwright redirect handling. Strict SSRF checks implemented via DNS pinning can be circumvented when request-time navigation occurs during a redirect, allowing traversal to otherwise-blocked private addresses. The GHSA advisory explicitly scopes this to OpenClaw's user-controlled local assistant trust model, not a multi-tenant service boundary. No public exploit code exists and SSVC indicates exploitation status as none at time of analysis.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Server-side request forgery in NVIDIA NemoClaw's validateEndpointUrl() function allows local attackers with user interaction to supply crafted endpoint URLs targeting the 0.0.0.0/8 address range via blueprint configuration files or CLI flags, leading to information disclosure. The vulnerability affects all versions of NemoClaw and requires local access with user interaction to trigger, limiting exposure to systems where untrusted users can modify configuration or invoke CLI commands.
Server-side request forgery (SSRF) in o2oa up to version 10.0 allows authenticated remote attackers to manipulate the fileUrl parameter in the FileAction component to trigger arbitrary HTTP requests from the server. The vulnerability requires authenticated access (PR:L) but can facilitate attacks against internal services, exfiltrate sensitive data, or pivot to backend systems. Publicly available exploit code exists, and the vendor has not yet responded to early notification.
Server-side request forgery (SSRF) in BigSweetPotatoStudio HyperChat up to version 2.0.0-alpha.63 allows remote unauthenticated attackers to manipulate the baseurl argument in the AI Proxy Middleware component, enabling arbitrary HTTP requests from the affected server. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting confidentiality, integrity, and availability impact at the network level with low complexity. The vendor has not responded to early disclosure notification through the project's GitHub issue tracker.
Server-side request forgery (SSRF) in TencentCloudBase CloudBase-MCP through version 2.17.0 allows remote unauthenticated attackers to manipulate the open-url API endpoint by injecting arbitrary URLs via the req.body.url parameter, enabling attackers to make unauthorized requests from the server to internal or external resources. The vulnerability has publicly available exploit code and affects the openUrl function in mcp/src/interactive-server.ts. Vendor-released patch version 2.17.1 is available.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Server-Side Request Forgery in dmitryglhf's mcp-url-downloader MCP server allows unauthenticated remote attackers to manipulate the url argument passed to the _validate_url_safe function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. The flaw exposes any internal network resources reachable by the host - including cloud instance metadata endpoints - to external actors with network access to the service. A public proof-of-concept has been disclosed (SSVC: poc, Automatable: yes); the vendor has not yet responded to responsible disclosure, and no patched release exists.
Server-side request forgery in the auto-favicon MCP tool's generate_favicon_from_url function enables authenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the internet. All versions of dh1011/auto-favicon-mcp up to commit f189116a9259950c2393f114dbcb94dde0ad864b are affected, with no vendor patch available. A public exploit has been disclosed; however, EPSS sits at 0.03% (10th percentile) and CISA SSVC rates it non-automatable with partial technical impact, placing real-world exploitation risk at the lower end of the threat spectrum.
Server-side request forgery in AlejandroArciniegas mcp-data-vis allows unauthenticated remote attackers to cause the server to issue arbitrary outbound HTTP requests via the `axios`-based HTTP Request Handler in `src/servers/web-scraper/server.js`. Attackers can leverage this to probe internal network services, cloud metadata endpoints, or bypass perimeter controls from the server's network context. A public proof-of-concept exploit exists (SSVC: poc, Automatable: yes), though EPSS remains low at 0.04% (12th percentile), consistent with the tool's obscure deployment footprint.
Server-side request forgery in JoeCastrom mcp-chat-studio (all versions through 1.5.0) allows unauthenticated remote attackers to forge arbitrary server-initiated HTTP requests by injecting a malicious URL into the `base_url` query parameter of the LLM Models API (`server/routes/llm.js`). A public exploit exists via GitHub issue report, and SSVC classifies this as automatable - meaning it can be scripted for broad scanning. No patch has been issued; the maintainer has not responded to the coordinated disclosure.
Server-side request forgery in ShadowCloneLabs GlutamateMCPServers allows remote unauthenticated attackers to manipulate the 'url' parameter in the puppeteer_navigate component (src/puppeteer/index.ts), potentially accessing internal resources or conducting network reconnaissance. A publicly available proof-of-concept exploit exists (GitHub). EPSS data not available, but CVSS 7.3 (High) with network vector, low complexity, and no authentication requirements indicates significant accessibility. The vendor has not responded to early disclosure via GitHub issue #8, and no patch timeline exists due to the project's rolling release model.
Server-side request forgery in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to manipulate the Link parameter in the getCodeByLink endpoint, enabling arbitrary HTTP requests from the server. The vendor acknowledges the /getCodeByLink interface is inherently high-risk and designed to fetch and execute TypeScript code locally; public exploit code exists but vendor questions the practical exploitability of the reported vulnerability.
Server-side request forgery (SSRF) in BuildingAI up to version 26.0.1 allows remote unauthenticated attackers to abuse the Remote Upload API's uploadRemoteFile function by manipulating the url parameter, enabling unauthorized access to internal resources, data exfiltration from cloud metadata services, and potential pivoting to internal network systems. A publicly available exploit exists (GitHub issue #110), but the vendor has not responded to disclosure. CVSS 7.3 with EPSS data unavailable; exploitation requires no authentication and low attack complexity (AV:N/AC:L/PR:N/UI:N), making this a high-priority remediation target despite unknown CISA KEV status.
Server-side request forgery in Typecho's Pingback Service (versions up to 1.3.0) allows remote unauthenticated attackers to force the server to make arbitrary HTTP requests to internal or external resources. The vulnerability resides in Service::sendPingHandle() function where attacker-controlled X-Pingback and link parameters bypass validation. Public exploit code exists (documented in researcher blog post), enabling immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required. EPSS data not available, but public POC significantly elevates real-world risk. Vendor non-responsive to early disclosure.
Server-side request forgery (SSRF) in Pagekit up to version 1.0.18 allows authenticated high-privilege administrators to manipulate the url parameter in the /index.php/admin/system/update/download endpoint, enabling them to force the server to make arbitrary HTTP requests to internal or external systems. Publicly available exploit code exists, and the vendor did not respond to early disclosure efforts.
Server-side request forgery (SSRF) in AiraHub2 allows authenticated remote attackers to manipulate the connect_stream_endpoint and sync_agents functions in AiraHub.py, enabling arbitrary HTTP requests to internal or external systems. The vulnerability affects multiple endpoints and has publicly available exploit code; however, the vendor has not responded to disclosure attempts and uses a rolling release model, making patch status unclear.
Server-side request forgery (SSRF) in devlikeapro WAHA up to version 2026.3.4 allows authenticated remote attackers to forge requests from the server via the media.controller.ts API endpoint, enabling potential reconnaissance, internal resource access, and lateral movement attacks. Publicly available exploit code exists and the vendor has not responded to disclosure efforts.
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.
SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.
Axios versions prior to 1.15.1 and 0.31.1 fail to properly bypass proxy configurations when no_proxy=localhost is set, allowing attackers to route requests to loopback addresses (127.0.0.1 and [::1]) through proxy servers instead of bypassing them. This Server-Side Request Forgery (SSRF) vulnerability arises because the shouldBypassProxy() function performs only string matching without resolving IP aliases or loopback equivalents, potentially exposing internal services to proxy interception or manipulation with a CVSS score of 6.8 (high confidentiality impact over changed scope).
Server-Side Request Forgery in Xibo CMS prior to version 4.4.1 allows high-privilege authenticated users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources, enabling infrastructure reconnaissance, cloud metadata access (e.g., AWS IMDS), and potential data exfiltration. Exploitation requires both 'Add DataSet' privilege and DataSet management capabilities, which are not default non-admin permissions, limiting the attack surface to trusted insiders or compromised administrative accounts.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
SSRF via redirect-following in the @astrojs/cloudflare integration's `image-binding-transform` endpoint allows remote attackers to bypass the `image.domains` and `image.remotePatterns` domain allowlist by exploiting an open redirect on an already-permitted domain. The root cause is a single missing `{ redirect: 'manual' }` option on line 28 of `image-binding-transform.ts` - an inconsistency that was correctly applied in all three other image fetch paths in the same codebase. This is an incomplete fix for the prior HIGH-rated GHSA-qpr4-c339-7vq8, and a public proof-of-concept is confirmed in advisory GHSA-88gm-j2wx-58h6.
Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized `uri` parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.
Blind Server-Side Request Forgery (SSRF) in Squidex prior to version 7.23.0 allows authenticated administrators to force the backend server to interact with the local filesystem via the `file://` protocol in the Restore API's `Url` parameter, potentially disclosing sensitive system information through side-channel analysis of internal logs. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in WeKan before 8.35 allows authenticated users to create or modify webhook integrations with arbitrary URLs, enabling the server to issue HTTP POST requests to internal network addresses and attacker-controlled targets. The vulnerability additionally permits unauthorized modification of comment text through response handling, affecting systems where users have integration management privileges. No active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery (SSRF) in Craft CMS 4.x through 4.17.8 and 5.x through 5.9.14 allows unauthenticated attackers to proxy arbitrary remote HTTP requests via the `resource-js` endpoint when `trustedHosts` is not explicitly configured. By manipulating the Host header, attackers can control the derived `baseUrl` used in validation, bypassing prefix checks and forcing the server to issue requests to arbitrary destinations. Patch versions 4.17.9 and 5.9.15 address the vulnerability.
Server-Side Request Forgery in Craft CMS 4.x through 4.17.8 and 5.x through 5.9.14 allows authenticated users with asset management permissions to request arbitrary URLs via the GraphQL API, potentially exposing internal services or performing actions on behalf of the CMS server. Exploitation requires high-privilege role assignments ('Edit assets' and 'Create assets' in a volume) and is patched in versions 4.17.9 and 5.9.15. EPSS score indicates moderate exploitation probability despite high CVSS, suggesting this is primarily a risk in multi-user CMS deployments where privilege separation is weak.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Server-Side Request Forgery (SSRF) in FreeScout versions before 1.8.213 allows authenticated administrators to probe internal networks and fingerprint services via unvalidated IMAP and SMTP connection test functionality. Three AJAX actions in MailboxesController pass attacker-controlled server hostnames and ports directly to fsockopen() and protocol clients without IP validation, hostname restrictions, or internal-range blocklists, enabling port scanning and service banner disclosure through IMAP debug logs and AJAX responses. The vulnerability requires admin authentication but affects confidentiality of internal infrastructure.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
Server-Side Request Forgery in Vexa meeting bot allows unauthenticated remote attackers to forge HTTP POST requests to arbitrary internal URLs (Redis, databases, cloud metadata endpoints) via unvalidated webhook configuration, enabling credential theft and lateral movement. CVSS 5.8 with network attack vector and no user interaction required. Fixed in version 0.10.0-260419-1910.
Server-side request forgery in Qibo CMS 1.0 allows authenticated remote attackers to manipulate the 'starts' parameter in /index/image/headers endpoint, triggering arbitrary internal requests from the server. Publicly available exploit code exists. The vendor did not respond to early disclosure notification, leaving no patched version available.
Server-side request forgery (SSRF) in Mogu Blog v2 up to version 5.2 allows unauthenticated remote attackers to initiate arbitrary HTTP requests from the affected server through the picture upload functionality. The vulnerability exists in the LocalFileServiceImpl.uploadPictureByUrl method within the Picture Storage Service component, enabling attackers to access internal services, scan internal networks, or exfiltrate sensitive data. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications.
Server-side request forgery in Dify up to version 1.13.3 allows authenticated remote attackers to manipulate the URL argument in the ApiBasedToolSchemaParser component, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability affects the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Server-side request forgery (SSRF) in Dify's ApiToolManageService allows authenticated remote attackers to manipulate the URL argument in the get_api_tool_provider_remote_schema function, enabling them to make arbitrary HTTP requests from the server. Affects Dify versions up to 0.6.9. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to manipulate the WebScraperTool's webpage extraction functions (extract_with_bs4, extract_with_3k, extract_with_lxml) to forge requests to arbitrary servers. The vulnerability has publicly available exploit code and low vendor responsiveness, creating immediate risk for deployments using affected versions.
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_audio_block function that allows remote unauthenticated attackers to manipulate the 'url' argument and trigger arbitrary HTTP requests from the vulnerable server. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected deployments without an official patch.
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate the _get_bytes_from_web_url function in src/agentscope/_utils/_common.py, enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts, leaving affected installations vulnerable to attackers probing internal networks and services.
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate image_url and audio_file_url parameters in the _parse_url, prepare_image, and openai_audio_to_text functions, enabling arbitrary HTTP requests from the affected server. The vulnerability has publicly available exploit code and affects the Cloud Metadata Endpoint component. The vendor has not responded to early disclosure attempts, and exploitation is confirmed to be possible with low attack complexity.
Server-side request forgery in vibrantlabsai RAGAS up to version 0.4.3 allows authenticated remote attackers to manipulate the retrieved_contexts argument in the Collections Module's _try_process_local_file and _try_process_url functions, enabling arbitrary file reads and network requests with the application's privileges. Publicly available exploit code exists; the vendor has not responded to early disclosure attempts despite the security patch for related CVE-2025-45691 being applied to a different module only.
Server-side request forgery in PHPEMS 11.0 allows authenticated remote attackers to manipulate the uploadfile parameter in the Instant Exam Creation Handler component, enabling SSRF attacks that can access internal resources or perform unauthorized requests from the server. The vulnerability affects the temppage function in /app/exam/controller/exams.master.php and has public exploit code available, though exploitation requires valid user credentials (PR:L).
mcp-neo4j-cypher before version 0.6.0 allows authenticated users to bypass read-only mode enforcement via APOC CALL procedures, enabling unauthorized write operations and server-side request forgery against Neo4j databases. The vulnerability requires login credentials and attacker preparation (CVSS AT:P), limiting real-world risk to insider threats or compromised accounts with legitimate access to the MCP server.
Server-side request forgery (SSRF) in TinyFileManager file upload handler (versions up to 2.6) allows authenticated remote attackers to manipulate the uploadurl parameter and forge requests to arbitrary servers. The vulnerability affects the /filemanager.php?p=&ajax=true&type=upload endpoint and has publicly available exploit code; the vendor has not responded to disclosure attempts.
GREENmod before 2.8.33 allows remote code execution and server-side request forgery via incorrectly configured named pipes that accept unauthenticated XML or JSON file uploads, processing them with service-level privileges on Windows systems. An attacker on the network can abuse this to trigger SSRF attacks against SMB or WebDAV targets accessible to the service account, potentially compromising internal Windows infrastructure without authentication.
Server-side request forgery (SSRF) in HashiCorp Vault's PKI engine ACME validation allows unauthenticated remote attackers to send http-01 and tls-alpn-01 challenge requests to local network targets by controlling DNS responses, potentially disclosing sensitive information from internal services. The vulnerability affects Vault Community Edition before 2.0.0 and Vault Enterprise before 1.19.16, 1.20.10, or 1.21.5. HashiCorp has released patched versions; no public exploit code has been identified at the time of analysis.
Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.
Server-side request forgery (SSRF) in NocoBase's workflow HTTP request and custom request action plugins allows authenticated workspace members to access internal network services, cloud metadata endpoints, and localhost. The vulnerability has a public proof-of-concept and a low EPSS exploitation probability, with no confirmed active exploitation. A vendor-released patch is available in version 2.0.37.
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery in Weblate prior to version 5.17 allows authenticated users to bypass the ALLOWED_ASSET_DOMAINS allowlist via HTTP redirects, forcing the server to request unintended hosts. This can lead to low confidentiality impact through information disclosure. The vulnerability is fixed in version 5.17, and no public exploit or active exploitation has been identified.
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
Server-Side Request Forgery in EspoCRM 9.3.3 and below allows authenticated attackers to bypass internal IP restrictions via a DNS rebinding race condition in the image attachment endpoint, enabling internal network reconnaissance. The root cause is a split-resolver design: host validation uses dns_get_record() while the actual HTTP fetch uses curl's independent gethostbyname() resolver - attacker-controlled DNS can return a public IP for validation and an internal IP for the actual request. A secondary bypass exists where empty DNS results cause validation to silently permit the host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a POC is publicly available and the vendor-confirmed fix shipped in 9.3.4.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
Authenticated SSRF in EspoCRM 9.3.3 and below allows credential-holding users to bypass internal-host validation by supplying alternative IPv4 representations (e.g., octal-encoded loopback `0177.0.0.1`) to the `/api/v1/Attachment/fromImageUrl` endpoint, causing the server to fetch and store responses from loopback-bound internal services. A public exploit is confirmed on Exploit-DB (52583), though EPSS is very low (0.03%, 7th percentile) and CISA KEV status has not been assigned, indicating limited observed mass exploitation. Vendor-released patch version 9.3.4 is available and resolves the issue.
Server-side request forgery (SSRF) in AstrBot API endpoint post_data.get allows authenticated remote attackers to perform arbitrary HTTP requests from the server, potentially exposing internal services or enabling data exfiltration. AstrBot versions up to 4.22.1 are affected. Publicly available exploit code exists, though vendor response remains pending despite early notification.
Server-side request forgery (SSRF) in FoundationAgents MetaGPT up to version 0.8.1 allows authenticated remote attackers to conduct arbitrary requests via manipulation of the img_url_or_b64 parameter in the decode_image function of metagpt/utils/common.py. Publicly available exploit code exists, and a vendor patch has been released. The vulnerability carries a CVSS score of 6.3 with low confidentiality, integrity, and availability impact, but requires low-level authentication to exploit.
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and above to force the WordPress server to make arbitrary HTTP requests via the uwp_crop parameter in avatar/banner image crop operations. The vulnerability stems from insufficient URL origin validation in the process_image_crop() method, which accepts user-controlled URLs and passes them to PHP image processing functions that support URL wrappers, enabling internal network reconnaissance and potential access to sensitive services. No public exploit code or active exploitation has been confirmed, though the vulnerability requires only authenticated access and low attack complexity.
GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to probe internal networks, including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by submitting a crafted WMS service URL during form validation. The vulnerability exploits insufficient URL validation without private IP filtering or allowlist enforcement. No public exploit code has been identified at the time of analysis.
Server-side request forgery in GeoNode 4.0-4.4.4 and 5.0-5.0.1 allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by supplying a malicious URL via the doc_url parameter, enabling attacks against internal network resources, loopback addresses, RFC1918 networks, and cloud metadata services without SSRF mitigations. CVSS 5.3 reflects low confidentiality and integrity impact but requires prior authentication; no public exploit code or active exploitation has been identified.
Server-side request forgery (SSRF) in FastGPT versions prior to 4.14.10.3 allows unauthenticated remote attackers to probe and access internal network resources via the /api/core/app/mcpTools/runTool endpoint, which accepts arbitrary URLs without proper validation. The vulnerability is exploitable by default because the internal IP check is gated behind a disabled configuration flag (CHECK_INTERNAL_IP=false), enabling attackers to bypass network segmentation and potentially discover or interact with backend services, databases, or cloud metadata endpoints.
Server-side request forgery (SSRF) in OpenClaw's assertPublicHostname handler (src/agents/tools/web-fetch.ts) allows remote attackers to craft requests that bypass hostname validation and reach internal or restricted systems. Affected versions up to 2026.1.26 are vulnerable; the attack requires high complexity but publicly available exploit code exists. Vendor-released patch version 2026.1.29 (commit b623557a2ec7e271bda003eb3ac33fbb2e218505) resolves the issue.
Server-side request forgery (SSRF) in OpenClaw before version 2026.3.25 allows authenticated attackers to bypass configured endpoint protections through unguarded fetch() calls in channel extensions, enabling rebinding of requests to internal resources and potential unauthorized access to restricted services. The vulnerability affects multiple channel extensions that fail to properly validate or restrict base URL usage, with a CVSS score of 5.3 reflecting moderate risk due to required authentication and limited initial impact scope.
Server-Side Request Forgery in web3.py 6.0.0b3 through 7.14.x and 8.0.0b1 enables malicious smart contracts to force the library to issue HTTP requests to arbitrary destinations via CCIP Read (EIP-3668) URL templates without destination validation. The vulnerability affects all applications using web3.py's .call() method against untrusted contract addresses, as CCIP Read is enabled by default, allowing attackers to target internal network services and cloud metadata endpoints. The issue is remedied in versions 7.15.0 and 8.0.0b2.
Hostname normalization bypass in Axios (JavaScript HTTP client) versions prior to 1.15.0 allows unauthenticated remote attackers to circumvent NO_PROXY configuration rules and force HTTP requests through configured proxies. Attackers can exploit malformed loopback addresses (localhost. with trailing dot, [::1] IPv6 literals) to bypass proxy restrictions and conduct Server-Side Request Forgery (SSRF) attacks against protected internal services. Publicly available exploit code exists. Affects all Axios implementations in Node.js and browser environments with NO_PROXY configurations.
Server-Side Request Forgery (SSRF) in atototo api-lab-mcp versions up to 0.2.1 allows unauthenticated remote attackers to manipulate source/url parameters in analyze_api_spec, generate_test_scenarios, and test_http_endpoint functions within the HTTP interface (http-server.ts). Exploitation permits unauthorized requests to internal or external resources, potentially exposing sensitive data, bypassing access controls, or conducting port scanning. Publicly available exploit code exists. Vendor has not responded to early disclosure (GitHub issue #4).
Server-Side Request Forgery in Jizhicms v2.5.4 allows unauthenticated remote attackers to abuse User Evaluation, Message, and Comment modules to make arbitrary HTTP requests from the server. With critical CVSS 9.1 (AV:N/AC:L/PR:N/UI:N), attackers can achieve high confidentiality and integrity impact without authentication. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, and no vendor-released patch confirmed
Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request arbitrary internal URLs when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled, bypassing URL validation through HTTP redirect chains. An attacker with valid credentials can probe internal networks, access cloud metadata endpoints, or interact with backend services not exposed to the public internet by supplying crafted remote_image URLs that are fetched server-side without IP-range restrictions.
Server-side request forgery (SSRF) in bigsk1 openai-realtime-ui allows authenticated remote attackers to manipulate API proxy endpoint query parameters in server.js, enabling the server to make arbitrary requests to internal or external resources. The vulnerability affects all versions up to commit 188ccde27fdf3d8fab8da81f3893468f53b2797c, has publicly available exploit code, and carries a CVSS 5.3 score reflecting moderate impact with authentication required. A fix is available via commit 54f8f50f43af97c334a881af7b021e84b5b8310f.
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization administrators to force the Quay server to make unvalidated network requests to internal services, cloud infrastructure endpoints, or otherwise restricted resources by supplying a crafted upstream registry hostname. With CVSS 5.2 and high confidentiality impact, this vulnerability requires administrator privileges and user interaction but poses significant risk to internal network exposure; no public exploit code or active exploitation (KEV) confirmed at time of analysis.
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct arbitrary requests to internal network resources via a specially crafted URL in the log export feature, potentially exposing sensitive information and compromising internal systems. CVSS 6.5 (medium severity) with confirmed authentication requirement and high confidentiality impact. No active exploitation or public exploit code identified at time of analysis.
Server-Side Request Forgery (SSRF) in Podigee plugin versions up to 1.4.0 allows remote attackers to make arbitrary HTTP requests from the affected server to internal or external resources without authentication. The vulnerability has a moderate CVSS score of 5.4 with low confidentiality and integrity impact across trust boundaries (AV:N/AC:H/PR:N). EPSS exploitation probability is very low at 0.02% (4th percentile), indicating minimal real-world attack likelihood despite public vulnerability disclosure.
Server-Side Request Forgery (SSRF) in Brecht Visual Link Preview WordPress plugin versions through 2.3.0 allows authenticated attackers with low privileges to make arbitrary network requests from the affected server, potentially accessing internal resources, metadata services, or performing actions on behalf of the server. No public exploit code identified at time of analysis, though the vulnerability carries low real-world exploitation probability (EPSS 0.02%) despite moderate CVSS scoring.
Server-Side Request Forgery (SSRF) in Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin versions up to 5.11 allows unauthenticated remote attackers to forge requests to internal or external systems with high attack complexity, affecting confidentiality and integrity of data accessible from the server. EPSS scoring of 0.02% indicates minimal real-world exploitation probability despite moderate CVSS severity (5.4), and no active exploitation has been confirmed; patch availability status requires vendor verification.
Server-side request forgery in SpringBlade v4.8.0 allows authenticated network attackers to scan internal resources by sending crafted GET requests to the /ureport/datasource/testConnection endpoint, enabling reconnaissance of non-routable or restricted-access network segments. The vulnerability affects confidentiality but requires valid authentication credentials to exploit.
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/{name}/upgrade-from-uri endpoint permits authenticated attackers to scan internal network resources and retrieve sensitive data via crafted GET requests, potentially enabling reconnaissance of internal infrastructure. The vulnerability requires valid authentication credentials but operates with low attack complexity, affecting the confidentiality of internal resources without requiring user interaction or administrative privileges.
Server-side request forgery (SSRF) in Halo v2.22.14's /themes/{name}/upgrade-from-uri endpoint allows authenticated attackers to scan internal network resources and services by submitting crafted GET requests, enabling reconnaissance of backend infrastructure without direct network access.
Server-side request forgery in Halo v2.22.14 /themes/-/install-from-uri endpoint allows authenticated attackers to scan internal resources and access sensitive network information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity and results in confidentiality impact through information disclosure of internal network topology and services.
Server-Side Request Forgery (SSRF) in Halo v2.22.14's /plugins/-/install-from-uri endpoint enables authenticated attackers to scan internal resources and potentially access sensitive information via crafted GET requests. The vulnerability requires valid authentication credentials but operates with low attack complexity over the network, exposing internal network topology and services to enumeration attacks.
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the `media_paths` argument of the `xhs_publish_content` MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
Server-Side Request Forgery in Dell Disk Library for Mainframe (DLm8700 and DLm2700, versions prior to 7.0.1.0) enables a low-privileged remote attacker to coerce the appliance into issuing server-side HTTP requests to arbitrary internal or external resources. The vulnerability is scored CVSS 4.3 Medium and carries an EPSS of 0.01% (1st percentile), reflecting negligible real-world exploitation probability. No public exploit code exists and CISA SSVC assessment confirms no active exploitation and non-automatable attack path.
Server-side request forgery in Xuxueli xxl-job 3.3.0-3.3.2 allows an authenticated admin-panel user to supply arbitrary URLs in the `addressList` parameter of the manual job trigger endpoint, causing the server to issue outbound HTTP requests to attacker-specified internal or external destinations. The vulnerability is publicly disclosed with exploit code available, but the project maintainer formally disputes its severity, asserting the trigger endpoint is protected by login and role-based access control, and rejected the fix PR. No patched release exists; EPSS at 0.04% and absence from CISA KEV indicate minimal observed in-the-wild exploitation.
Server-side request forgery bypass in OpenClaw (npm) before 2026.4.8 allows authenticated users to reach private internal network targets by exploiting a race condition in Playwright redirect handling. Strict SSRF checks implemented via DNS pinning can be circumvented when request-time navigation occurs during a redirect, allowing traversal to otherwise-blocked private addresses. The GHSA advisory explicitly scopes this to OpenClaw's user-controlled local assistant trust model, not a multi-tenant service boundary. No public exploit code exists and SSVC indicates exploitation status as none at time of analysis.
Server-side request forgery in OpenClaw's QQ Bot Extension (npm package, all versions before 2026.4.8) allows authenticated users to route media fetch requests through unprotected endpoints, bypassing the configured SSRF guard and allowlist policies. Internal network resources - including metadata services and private APIs - are reachable via the subsequent-system scope change even though the OpenClaw host itself sustains no direct confidentiality impact. No public exploit code or active exploitation has been identified; EPSS stands at 0.03% and SSVC categorizes exploitation status as none.
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Server-side request forgery in NVIDIA NemoClaw's validateEndpointUrl() function allows local attackers with user interaction to supply crafted endpoint URLs targeting the 0.0.0.0/8 address range via blueprint configuration files or CLI flags, leading to information disclosure. The vulnerability affects all versions of NemoClaw and requires local access with user interaction to trigger, limiting exposure to systems where untrusted users can modify configuration or invoke CLI commands.
Server-side request forgery (SSRF) in o2oa up to version 10.0 allows authenticated remote attackers to manipulate the fileUrl parameter in the FileAction component to trigger arbitrary HTTP requests from the server. The vulnerability requires authenticated access (PR:L) but can facilitate attacks against internal services, exfiltrate sensitive data, or pivot to backend systems. Publicly available exploit code exists, and the vendor has not yet responded to early notification.
Server-side request forgery (SSRF) in BigSweetPotatoStudio HyperChat up to version 2.0.0-alpha.63 allows remote unauthenticated attackers to manipulate the baseurl argument in the AI Proxy Middleware component, enabling arbitrary HTTP requests from the affected server. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting confidentiality, integrity, and availability impact at the network level with low complexity. The vendor has not responded to early disclosure notification through the project's GitHub issue tracker.
Server-side request forgery (SSRF) in TencentCloudBase CloudBase-MCP through version 2.17.0 allows remote unauthenticated attackers to manipulate the open-url API endpoint by injecting arbitrary URLs via the req.body.url parameter, enabling attackers to make unauthorized requests from the server to internal or external resources. The vulnerability has publicly available exploit code and affects the openUrl function in mcp/src/interactive-server.ts. Vendor-released patch version 2.17.1 is available.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Server-Side Request Forgery in dmitryglhf's mcp-url-downloader MCP server allows unauthenticated remote attackers to manipulate the url argument passed to the _validate_url_safe function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. The flaw exposes any internal network resources reachable by the host - including cloud instance metadata endpoints - to external actors with network access to the service. A public proof-of-concept has been disclosed (SSVC: poc, Automatable: yes); the vendor has not yet responded to responsible disclosure, and no patched release exists.
Server-side request forgery in the auto-favicon MCP tool's generate_favicon_from_url function enables authenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the internet. All versions of dh1011/auto-favicon-mcp up to commit f189116a9259950c2393f114dbcb94dde0ad864b are affected, with no vendor patch available. A public exploit has been disclosed; however, EPSS sits at 0.03% (10th percentile) and CISA SSVC rates it non-automatable with partial technical impact, placing real-world exploitation risk at the lower end of the threat spectrum.
Server-side request forgery in AlejandroArciniegas mcp-data-vis allows unauthenticated remote attackers to cause the server to issue arbitrary outbound HTTP requests via the `axios`-based HTTP Request Handler in `src/servers/web-scraper/server.js`. Attackers can leverage this to probe internal network services, cloud metadata endpoints, or bypass perimeter controls from the server's network context. A public proof-of-concept exploit exists (SSVC: poc, Automatable: yes), though EPSS remains low at 0.04% (12th percentile), consistent with the tool's obscure deployment footprint.
Server-side request forgery in JoeCastrom mcp-chat-studio (all versions through 1.5.0) allows unauthenticated remote attackers to forge arbitrary server-initiated HTTP requests by injecting a malicious URL into the `base_url` query parameter of the LLM Models API (`server/routes/llm.js`). A public exploit exists via GitHub issue report, and SSVC classifies this as automatable - meaning it can be scripted for broad scanning. No patch has been issued; the maintainer has not responded to the coordinated disclosure.
Server-side request forgery in ShadowCloneLabs GlutamateMCPServers allows remote unauthenticated attackers to manipulate the 'url' parameter in the puppeteer_navigate component (src/puppeteer/index.ts), potentially accessing internal resources or conducting network reconnaissance. A publicly available proof-of-concept exploit exists (GitHub). EPSS data not available, but CVSS 7.3 (High) with network vector, low complexity, and no authentication requirements indicates significant accessibility. The vendor has not responded to early disclosure via GitHub issue #8, and no patch timeline exists due to the project's rolling release model.
Server-side request forgery in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to manipulate the Link parameter in the getCodeByLink endpoint, enabling arbitrary HTTP requests from the server. The vendor acknowledges the /getCodeByLink interface is inherently high-risk and designed to fetch and execute TypeScript code locally; public exploit code exists but vendor questions the practical exploitability of the reported vulnerability.
Server-side request forgery (SSRF) in BuildingAI up to version 26.0.1 allows remote unauthenticated attackers to abuse the Remote Upload API's uploadRemoteFile function by manipulating the url parameter, enabling unauthorized access to internal resources, data exfiltration from cloud metadata services, and potential pivoting to internal network systems. A publicly available exploit exists (GitHub issue #110), but the vendor has not responded to disclosure. CVSS 7.3 with EPSS data unavailable; exploitation requires no authentication and low attack complexity (AV:N/AC:L/PR:N/UI:N), making this a high-priority remediation target despite unknown CISA KEV status.
Server-side request forgery in Typecho's Pingback Service (versions up to 1.3.0) allows remote unauthenticated attackers to force the server to make arbitrary HTTP requests to internal or external resources. The vulnerability resides in Service::sendPingHandle() function where attacker-controlled X-Pingback and link parameters bypass validation. Public exploit code exists (documented in researcher blog post), enabling immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required. EPSS data not available, but public POC significantly elevates real-world risk. Vendor non-responsive to early disclosure.
Server-side request forgery (SSRF) in Pagekit up to version 1.0.18 allows authenticated high-privilege administrators to manipulate the url parameter in the /index.php/admin/system/update/download endpoint, enabling them to force the server to make arbitrary HTTP requests to internal or external systems. Publicly available exploit code exists, and the vendor did not respond to early disclosure efforts.
Server-side request forgery (SSRF) in AiraHub2 allows authenticated remote attackers to manipulate the connect_stream_endpoint and sync_agents functions in AiraHub.py, enabling arbitrary HTTP requests to internal or external systems. The vulnerability affects multiple endpoints and has publicly available exploit code; however, the vendor has not responded to disclosure attempts and uses a rolling release model, making patch status unclear.
Server-side request forgery (SSRF) in devlikeapro WAHA up to version 2026.3.4 allows authenticated remote attackers to forge requests from the server via the media.controller.ts API endpoint, enabling potential reconnaissance, internal resource access, and lateral movement attacks. Publicly available exploit code exists and the vendor has not responded to disclosure efforts.
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.
SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.
Axios versions prior to 1.15.1 and 0.31.1 fail to properly bypass proxy configurations when no_proxy=localhost is set, allowing attackers to route requests to loopback addresses (127.0.0.1 and [::1]) through proxy servers instead of bypassing them. This Server-Side Request Forgery (SSRF) vulnerability arises because the shouldBypassProxy() function performs only string matching without resolving IP aliases or loopback equivalents, potentially exposing internal services to proxy interception or manipulation with a CVSS score of 6.8 (high confidentiality impact over changed scope).
Server-Side Request Forgery in Xibo CMS prior to version 4.4.1 allows high-privilege authenticated users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external resources, enabling infrastructure reconnaissance, cloud metadata access (e.g., AWS IMDS), and potential data exfiltration. Exploitation requires both 'Add DataSet' privilege and DataSet management capabilities, which are not default non-admin permissions, limiting the attack surface to trusted insiders or compromised administrative accounts.
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in `src/shared/net/ip.ts` and `src/infra/net/ssrf.*` omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
SSRF via redirect-following in the @astrojs/cloudflare integration's `image-binding-transform` endpoint allows remote attackers to bypass the `image.domains` and `image.remotePatterns` domain allowlist by exploiting an open redirect on an already-permitted domain. The root cause is a single missing `{ redirect: 'manual' }` option on line 28 of `image-binding-transform.ts` - an inconsistency that was correctly applied in all three other image fetch paths in the same codebase. This is an incomplete fix for the prior HIGH-rated GHSA-qpr4-c339-7vq8, and a public proof-of-concept is confirmed in advisory GHSA-88gm-j2wx-58h6.
Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized `uri` parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.
Blind Server-Side Request Forgery (SSRF) in Squidex prior to version 7.23.0 allows authenticated administrators to force the backend server to interact with the local filesystem via the `file://` protocol in the Restore API's `Url` parameter, potentially disclosing sensitive system information through side-channel analysis of internal logs. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in WeKan before 8.35 allows authenticated users to create or modify webhook integrations with arbitrary URLs, enabling the server to issue HTTP POST requests to internal network addresses and attacker-controlled targets. The vulnerability additionally permits unauthorized modification of comment text through response handling, affecting systems where users have integration management privileges. No active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery (SSRF) in Craft CMS 4.x through 4.17.8 and 5.x through 5.9.14 allows unauthenticated attackers to proxy arbitrary remote HTTP requests via the `resource-js` endpoint when `trustedHosts` is not explicitly configured. By manipulating the Host header, attackers can control the derived `baseUrl` used in validation, bypassing prefix checks and forcing the server to issue requests to arbitrary destinations. Patch versions 4.17.9 and 5.9.15 address the vulnerability.
Server-Side Request Forgery in Craft CMS 4.x through 4.17.8 and 5.x through 5.9.14 allows authenticated users with asset management permissions to request arbitrary URLs via the GraphQL API, potentially exposing internal services or performing actions on behalf of the CMS server. Exploitation requires high-privilege role assignments ('Edit assets' and 'Create assets' in a volume) and is patched in versions 4.17.9 and 5.9.15. EPSS score indicates moderate exploitation probability despite high CVSS, suggesting this is primarily a risk in multi-user CMS deployments where privilege separation is weak.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Server-Side Request Forgery (SSRF) in FreeScout versions before 1.8.213 allows authenticated administrators to probe internal networks and fingerprint services via unvalidated IMAP and SMTP connection test functionality. Three AJAX actions in MailboxesController pass attacker-controlled server hostnames and ports directly to fsockopen() and protocol clients without IP validation, hostname restrictions, or internal-range blocklists, enabling port scanning and service banner disclosure through IMAP debug logs and AJAX responses. The vulnerability requires admin authentication but affects confidentiality of internal infrastructure.
OpenClaw before version 2026.3.31 contains a server-side request forgery (SSRF) vulnerability in the marketplace plugin download functionality, where unguarded fetch() calls allow authenticated users with user interaction to make arbitrary network requests on behalf of the affected system. Remote attackers can access internal resources or interact with external services, potentially disclosing sensitive data or compromising internal infrastructure; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw before version 2026.3.31 allows authenticated users to exploit server-side request forgery (SSRF) through unvalidated HTTP redirects in the marketplace plugin download functionality, enabling access to internal resources and potential information disclosure. The marketplace.ts module fails to validate redirect destinations during archive downloads, permitting remote attackers with valid credentials and user interaction to redirect requests to arbitrary internal or external servers. Real-world exploitation is limited by authentication and interaction requirements, keeping the baseline CVSS at 4.8 (medium), though impact depends on network exposure of internal services.
Server-Side Request Forgery in Vexa meeting bot allows unauthenticated remote attackers to forge HTTP POST requests to arbitrary internal URLs (Redis, databases, cloud metadata endpoints) via unvalidated webhook configuration, enabling credential theft and lateral movement. CVSS 5.8 with network attack vector and no user interaction required. Fixed in version 0.10.0-260419-1910.
Server-side request forgery in Qibo CMS 1.0 allows authenticated remote attackers to manipulate the 'starts' parameter in /index/image/headers endpoint, triggering arbitrary internal requests from the server. Publicly available exploit code exists. The vendor did not respond to early disclosure notification, leaving no patched version available.
Server-side request forgery (SSRF) in Mogu Blog v2 up to version 5.2 allows unauthenticated remote attackers to initiate arbitrary HTTP requests from the affected server through the picture upload functionality. The vulnerability exists in the LocalFileServiceImpl.uploadPictureByUrl method within the Picture Storage Service component, enabling attackers to access internal services, scan internal networks, or exfiltrate sensitive data. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications.
Server-side request forgery in Dify up to version 1.13.3 allows authenticated remote attackers to manipulate the URL argument in the ApiBasedToolSchemaParser component, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability affects the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Server-side request forgery (SSRF) in Dify's ApiToolManageService allows authenticated remote attackers to manipulate the URL argument in the get_api_tool_provider_remote_schema function, enabling them to make arbitrary HTTP requests from the server. Affects Dify versions up to 0.6.9. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts.
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to manipulate the WebScraperTool's webpage extraction functions (extract_with_bs4, extract_with_3k, extract_with_lxml) to forge requests to arbitrary servers. The vulnerability has publicly available exploit code and low vendor responsiveness, creating immediate risk for deployments using affected versions.
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_audio_block function that allows remote unauthenticated attackers to manipulate the 'url' argument and trigger arbitrary HTTP requests from the vulnerable server. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected deployments without an official patch.
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate the _get_bytes_from_web_url function in src/agentscope/_utils/_common.py, enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts, leaving affected installations vulnerable to attackers probing internal networks and services.
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate image_url and audio_file_url parameters in the _parse_url, prepare_image, and openai_audio_to_text functions, enabling arbitrary HTTP requests from the affected server. The vulnerability has publicly available exploit code and affects the Cloud Metadata Endpoint component. The vendor has not responded to early disclosure attempts, and exploitation is confirmed to be possible with low attack complexity.
Server-side request forgery in vibrantlabsai RAGAS up to version 0.4.3 allows authenticated remote attackers to manipulate the retrieved_contexts argument in the Collections Module's _try_process_local_file and _try_process_url functions, enabling arbitrary file reads and network requests with the application's privileges. Publicly available exploit code exists; the vendor has not responded to early disclosure attempts despite the security patch for related CVE-2025-45691 being applied to a different module only.
Server-side request forgery in PHPEMS 11.0 allows authenticated remote attackers to manipulate the uploadfile parameter in the Instant Exam Creation Handler component, enabling SSRF attacks that can access internal resources or perform unauthorized requests from the server. The vulnerability affects the temppage function in /app/exam/controller/exams.master.php and has public exploit code available, though exploitation requires valid user credentials (PR:L).
mcp-neo4j-cypher before version 0.6.0 allows authenticated users to bypass read-only mode enforcement via APOC CALL procedures, enabling unauthorized write operations and server-side request forgery against Neo4j databases. The vulnerability requires login credentials and attacker preparation (CVSS AT:P), limiting real-world risk to insider threats or compromised accounts with legitimate access to the MCP server.
Server-side request forgery (SSRF) in TinyFileManager file upload handler (versions up to 2.6) allows authenticated remote attackers to manipulate the uploadurl parameter and forge requests to arbitrary servers. The vulnerability affects the /filemanager.php?p=&ajax=true&type=upload endpoint and has publicly available exploit code; the vendor has not responded to disclosure attempts.
GREENmod before 2.8.33 allows remote code execution and server-side request forgery via incorrectly configured named pipes that accept unauthenticated XML or JSON file uploads, processing them with service-level privileges on Windows systems. An attacker on the network can abuse this to trigger SSRF attacks against SMB or WebDAV targets accessible to the service account, potentially compromising internal Windows infrastructure without authentication.
Server-side request forgery (SSRF) in HashiCorp Vault's PKI engine ACME validation allows unauthenticated remote attackers to send http-01 and tls-alpn-01 challenge requests to local network targets by controlling DNS responses, potentially disclosing sensitive information from internal services. The vulnerability affects Vault Community Edition before 2.0.0 and Vault Enterprise before 1.19.16, 1.20.10, or 1.21.5. HashiCorp has released patched versions; no public exploit code has been identified at the time of analysis.
Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.
Server-side request forgery (SSRF) in NocoBase's workflow HTTP request and custom request action plugins allows authenticated workspace members to access internal network services, cloud metadata endpoints, and localhost. The vulnerability has a public proof-of-concept and a low EPSS exploitation probability, with no confirmed active exploitation. A vendor-released patch is available in version 2.0.37.
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery in Weblate prior to version 5.17 allows authenticated users to bypass the ALLOWED_ASSET_DOMAINS allowlist via HTTP redirects, forcing the server to request unintended hosts. This can lead to low confidentiality impact through information disclosure. The vulnerability is fixed in version 5.17, and no public exploit or active exploitation has been identified.
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
Server-Side Request Forgery in EspoCRM 9.3.3 and below allows authenticated attackers to bypass internal IP restrictions via a DNS rebinding race condition in the image attachment endpoint, enabling internal network reconnaissance. The root cause is a split-resolver design: host validation uses dns_get_record() while the actual HTTP fetch uses curl's independent gethostbyname() resolver - attacker-controlled DNS can return a public IP for validation and an internal IP for the actual request. A secondary bypass exists where empty DNS results cause validation to silently permit the host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though a POC is publicly available and the vendor-confirmed fix shipped in 9.3.4.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
Authenticated SSRF in EspoCRM 9.3.3 and below allows credential-holding users to bypass internal-host validation by supplying alternative IPv4 representations (e.g., octal-encoded loopback `0177.0.0.1`) to the `/api/v1/Attachment/fromImageUrl` endpoint, causing the server to fetch and store responses from loopback-bound internal services. A public exploit is confirmed on Exploit-DB (52583), though EPSS is very low (0.03%, 7th percentile) and CISA KEV status has not been assigned, indicating limited observed mass exploitation. Vendor-released patch version 9.3.4 is available and resolves the issue.
Server-side request forgery (SSRF) in AstrBot API endpoint post_data.get allows authenticated remote attackers to perform arbitrary HTTP requests from the server, potentially exposing internal services or enabling data exfiltration. AstrBot versions up to 4.22.1 are affected. Publicly available exploit code exists, though vendor response remains pending despite early notification.
Server-side request forgery (SSRF) in FoundationAgents MetaGPT up to version 0.8.1 allows authenticated remote attackers to conduct arbitrary requests via manipulation of the img_url_or_b64 parameter in the decode_image function of metagpt/utils/common.py. Publicly available exploit code exists, and a vendor patch has been released. The vulnerability carries a CVSS score of 6.3 with low confidentiality, integrity, and availability impact, but requires low-level authentication to exploit.
Blind Server-Side Request Forgery in UsersWP WordPress plugin versions up to 1.2.58 allows authenticated subscribers and above to force the WordPress server to make arbitrary HTTP requests via the uwp_crop parameter in avatar/banner image crop operations. The vulnerability stems from insufficient URL origin validation in the process_image_crop() method, which accepts user-controlled URLs and passes them to PHP image processing functions that support URL wrappers, enabling internal network reconnaissance and potential access to sensitive services. No public exploit code or active exploitation has been confirmed, though the vulnerability requires only authenticated access and low attack complexity.
GeoNode 4.0 before 4.4.5 and 5.0 before 5.0.2 contains a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to probe internal networks, including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by submitting a crafted WMS service URL during form validation. The vulnerability exploits insufficient URL validation without private IP filtering or allowlist enforcement. No public exploit code has been identified at the time of analysis.
Server-side request forgery in GeoNode 4.0-4.4.4 and 5.0-5.0.1 allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by supplying a malicious URL via the doc_url parameter, enabling attacks against internal network resources, loopback addresses, RFC1918 networks, and cloud metadata services without SSRF mitigations. CVSS 5.3 reflects low confidentiality and integrity impact but requires prior authentication; no public exploit code or active exploitation has been identified.
Server-side request forgery (SSRF) in FastGPT versions prior to 4.14.10.3 allows unauthenticated remote attackers to probe and access internal network resources via the /api/core/app/mcpTools/runTool endpoint, which accepts arbitrary URLs without proper validation. The vulnerability is exploitable by default because the internal IP check is gated behind a disabled configuration flag (CHECK_INTERNAL_IP=false), enabling attackers to bypass network segmentation and potentially discover or interact with backend services, databases, or cloud metadata endpoints.
Server-side request forgery (SSRF) in OpenClaw's assertPublicHostname handler (src/agents/tools/web-fetch.ts) allows remote attackers to craft requests that bypass hostname validation and reach internal or restricted systems. Affected versions up to 2026.1.26 are vulnerable; the attack requires high complexity but publicly available exploit code exists. Vendor-released patch version 2026.1.29 (commit b623557a2ec7e271bda003eb3ac33fbb2e218505) resolves the issue.
Server-side request forgery (SSRF) in OpenClaw before version 2026.3.25 allows authenticated attackers to bypass configured endpoint protections through unguarded fetch() calls in channel extensions, enabling rebinding of requests to internal resources and potential unauthorized access to restricted services. The vulnerability affects multiple channel extensions that fail to properly validate or restrict base URL usage, with a CVSS score of 5.3 reflecting moderate risk due to required authentication and limited initial impact scope.
Server-Side Request Forgery in web3.py 6.0.0b3 through 7.14.x and 8.0.0b1 enables malicious smart contracts to force the library to issue HTTP requests to arbitrary destinations via CCIP Read (EIP-3668) URL templates without destination validation. The vulnerability affects all applications using web3.py's .call() method against untrusted contract addresses, as CCIP Read is enabled by default, allowing attackers to target internal network services and cloud metadata endpoints. The issue is remedied in versions 7.15.0 and 8.0.0b2.
Hostname normalization bypass in Axios (JavaScript HTTP client) versions prior to 1.15.0 allows unauthenticated remote attackers to circumvent NO_PROXY configuration rules and force HTTP requests through configured proxies. Attackers can exploit malformed loopback addresses (localhost. with trailing dot, [::1] IPv6 literals) to bypass proxy restrictions and conduct Server-Side Request Forgery (SSRF) attacks against protected internal services. Publicly available exploit code exists. Affects all Axios implementations in Node.js and browser environments with NO_PROXY configurations.
Server-Side Request Forgery (SSRF) in atototo api-lab-mcp versions up to 0.2.1 allows unauthenticated remote attackers to manipulate source/url parameters in analyze_api_spec, generate_test_scenarios, and test_http_endpoint functions within the HTTP interface (http-server.ts). Exploitation permits unauthorized requests to internal or external resources, potentially exposing sensitive data, bypassing access controls, or conducting port scanning. Publicly available exploit code exists. Vendor has not responded to early disclosure (GitHub issue #4).
Server-Side Request Forgery in Jizhicms v2.5.4 allows unauthenticated remote attackers to abuse User Evaluation, Message, and Comment modules to make arbitrary HTTP requests from the server. With critical CVSS 9.1 (AV:N/AC:L/PR:N/UI:N), attackers can achieve high confidentiality and integrity impact without authentication. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, and no vendor-released patch confirmed
Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request arbitrary internal URLs when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled, bypassing URL validation through HTTP redirect chains. An attacker with valid credentials can probe internal networks, access cloud metadata endpoints, or interact with backend services not exposed to the public internet by supplying crafted remote_image URLs that are fetched server-side without IP-range restrictions.
Server-side request forgery (SSRF) in bigsk1 openai-realtime-ui allows authenticated remote attackers to manipulate API proxy endpoint query parameters in server.js, enabling the server to make arbitrary requests to internal or external resources. The vulnerability affects all versions up to commit 188ccde27fdf3d8fab8da81f3893468f53b2797c, has publicly available exploit code, and carries a CVSS 5.3 score reflecting moderate impact with authentication required. A fix is available via commit 54f8f50f43af97c334a881af7b021e84b5b8310f.
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization administrators to force the Quay server to make unvalidated network requests to internal services, cloud infrastructure endpoints, or otherwise restricted resources by supplying a crafted upstream registry hostname. With CVSS 5.2 and high confidentiality impact, this vulnerability requires administrator privileges and user interaction but poses significant risk to internal network exposure; no public exploit code or active exploitation (KEV) confirmed at time of analysis.
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct arbitrary requests to internal network resources via a specially crafted URL in the log export feature, potentially exposing sensitive information and compromising internal systems. CVSS 6.5 (medium severity) with confirmed authentication requirement and high confidentiality impact. No active exploitation or public exploit code identified at time of analysis.
Server-Side Request Forgery (SSRF) in Podigee plugin versions up to 1.4.0 allows remote attackers to make arbitrary HTTP requests from the affected server to internal or external resources without authentication. The vulnerability has a moderate CVSS score of 5.4 with low confidentiality and integrity impact across trust boundaries (AV:N/AC:H/PR:N). EPSS exploitation probability is very low at 0.02% (4th percentile), indicating minimal real-world attack likelihood despite public vulnerability disclosure.
Server-Side Request Forgery (SSRF) in Brecht Visual Link Preview WordPress plugin versions through 2.3.0 allows authenticated attackers with low privileges to make arbitrary network requests from the affected server, potentially accessing internal resources, metadata services, or performing actions on behalf of the server. No public exploit code identified at time of analysis, though the vulnerability carries low real-world exploitation probability (EPSS 0.02%) despite moderate CVSS scoring.
Server-Side Request Forgery (SSRF) in Sonaar MP3 Audio Player for Music, Radio & Podcast WordPress plugin versions up to 5.11 allows unauthenticated remote attackers to forge requests to internal or external systems with high attack complexity, affecting confidentiality and integrity of data accessible from the server. EPSS scoring of 0.02% indicates minimal real-world exploitation probability despite moderate CVSS severity (5.4), and no active exploitation has been confirmed; patch availability status requires vendor verification.