SSRF
Monthly
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to coerce the server into issuing arbitrary HTTP requests to internal or adjacent network resources, resulting in high-impact information disclosure. The CVSS scope-change flag (S:C) confirms that exploitation can expose resources beyond the SharePoint application boundary - including internal APIs, metadata services, or intranet hosts - making this a meaningful lateral-movement enabler despite its read-only impact. No public exploit code has been identified at time of analysis, and EPSS at 0.86% (56th percentile) suggests limited opportunistic exploitation so far.
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated server-side request forgery in MindsDB through 26.1.0 allows remote attackers to coerce the platform's web crawler handler into fetching arbitrary attacker-supplied URLs. The root cause is a default-empty allowlist in CrawlerTable.list (web_handler.py lines 50-65), meaning MindsDB ships with no URL restrictions enforced, enabling direct access to internal network services and cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). No public exploit has been confirmed at time of analysis, but VulnCheck published a detailed advisory with precise source-code references, lowering the bar to exploitation significantly.
Server-side request forgery in SQL Chat (the open-source sqlchat AI database client) lets remote unauthenticated attackers abuse four API endpoints (including /api/connection/execute and /api/connection/test) that accept client-supplied database connection parameters and run arbitrary SQL against any attacker-named host. Because no authentication is enforced, an attacker can point the server at internal databases, enumerate schemas, execute queries, and pivot through the SQL Chat host into otherwise unreachable network segments. No public exploit identified at time of analysis, though the affected source files and a VulnCheck advisory pinpoint the exact vulnerable code.
Server-side request forgery in Webstudio through 0.296.0 lets unauthenticated remote attackers abuse the /cgi/image, /cgi/video, and /cgi/asset proxy routes to fetch attacker-chosen URLs whenever the RESIZE_ORIGIN environment variable is unset. Because the proxy blindly forwards supplied URLs, an attacker can read cloud instance metadata (e.g. IMDS credentials), reach internal-only services, and map the instance's private network. Reported by VulnCheck with a public advisory; no public exploit code or CISA KEV listing is present at time of analysis.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker induce the gateway to issue outbound requests to attacker-chosen destinations, exposing sensitive information from systems reachable from the gateway's network position; the vendor rates it 9.6, while our independent assessment scores it 8.0 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) because exploitation requires both a valid authenticated session and attacker-controlled DNS with a winning re-resolution timing window. No public exploit code has been identified at time of analysis and there is no KEV listing; EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity. A vendor patch is available via IBM's advisory, and upgrading past v1.0.8 remediates.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to probe internal network infrastructure and cloud metadata services by exploiting a redirect-validation gap in the URL fetching pipeline. The service validates URLs on initial submission but fails to re-validate the destination after HTTP redirects, enabling attackers to pivot from an attacker-controlled public URL to cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254) or RFC-1918 internal addresses, with the response body returned to the attacker. No public exploit code has been independently confirmed at time of analysis, though a VulnCheck advisory and a public GitHub issue (jina-ai/reader#1252) detail the flaw.
Server-side request forgery and model spoofing in lm-sys FastChat let unauthenticated remote attackers register arbitrary workers via the controller's /register_worker endpoint, which performs no authentication. By registering a malicious worker address under a legitimate model's name, an attacker can silently intercept user prompts, uploaded images, and model responses, or coerce the controller into probing internal network ports across the worker mesh. No public exploit identified at time of analysis; the issue was reported by VulnCheck and CVSS 4.0 is scored 9.3.
Server-side request forgery in Nightingale (n9e), the open-source observability platform by ccfos, allows authenticated users of the http_fetch AI-agent tool to bypass the platform's SSRF guard by encoding forbidden IPv4 addresses using 6to4, NAT64, or deprecated site-local IPv6 representations. The isPublicIP function in aiagent/tools/http.go only unwraps standard ::ffff:a.b.c.d IPv4-mapped IPv6 addresses before applying the forbidden-range check, leaving 2002::/16 (6to4), 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64), and fec0::/10 (site-local) unrecognized and passable as 'public'. On dual-stack or NAT64-enabled cloud hosts, this allows an attacker to reach the cloud instance-metadata endpoint (169.254.169.254) or internal services and exfiltrate IAM credentials or sensitive configuration. No public exploit code has been identified at time of analysis.
Unauthenticated SSRF in MegaParse 0.0.55 allows any remote attacker to make the server issue arbitrary HTTP requests by supplying attacker-controlled URLs to the POST /v1/url endpoint, with full responses returned in the JSON reply. Because no authentication is required and the endpoint fetches URLs server-side without restriction, attackers can pivot to cloud provider metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-routable services that are reachable from the MegaParse host. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack surface is trivially exploitable against any internet-exposed deployment.
Server-side request forgery in ms-swift 4.5.2 allows unauthenticated remote attackers to weaponize the server's multimodal media fetching logic against internal infrastructure. The OpenAI-compatible deploy API accepts image_url, audio_url, and video_url parameters that are passed to vision_utils.py without URL validation or redirect filtering, enabling arbitrary outbound requests to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and network-adjacent services. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network-accessible attack surface and high confidentiality impact make this a significant risk for any internet-exposed ms-swift deployment.
Server-side request forgery in camel-ai OWL's DocumentProcessingToolkit exposes internal network resources to unauthenticated remote attackers across all tracked versions. The `extract_document_content` tool fetches caller-supplied URLs with no scheme, host, or IP allowlist, enabling attackers to pivot through the agent server to reach cloud metadata endpoints, internal APIs, or other SSRF-reachable services. The attack is delivered via prompt injection - malicious URL directives embedded in content processed by the OWL agent - with SSRF responses surfaced directly in the agent's context window, potentially leaking credentials or internal topology. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. No public exploit identified at time of analysis, but the flaw is remotely reachable against default deployments and was independently reported by VulnCheck.
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis.
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Server-Side Request Forgery in Apache Allura through version 1.20.0 lets attackers abuse the project webhook feature to coerce the server into issuing arbitrary outbound requests, enabling access to internal-only services and cloud metadata endpoints. The flaw is fixed in 1.21.0. No public exploit is identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating no observed mass-exploitation pressure despite the high CVSS.
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Server-side request forgery in OpenStack Glance before 32.0.1 allows authenticated cloud tenants to probe internal network endpoints by registering HTTP image locations that bypass host-restriction filtering. The location API - both POST /v2/images/{id}/locations and the PATCH API when show_multiple_locations is enabled - validates only the URL scheme and ignores the import_filtering_opts host allow-list that guards the web-download path, permitting requests to addresses such as the cloud metadata service at 169.254.169.254. A low-privileged tenant can then retrieve the server's response by downloading the image, potentially exposing ephemeral instance credentials or bootstrap secrets. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.0 with SC:H reflects genuine cross-boundary credential exposure risk on affected deployments.
Server-Side Request Forgery in Ollama versions 0.30.0 through 0.33.2 allows unauthenticated remote attackers to redirect the Ollama server's blob-download requests to arbitrary internal hosts, including cloud metadata endpoints such as the AWS instance metadata service. The flaw exists in the tensor-layer model pulling code path (x/transfer/download.go), where HTTP redirect destinations are not validated against an allowlist or the originating registry host. With no public exploit identified at time of analysis, the primary real-world impact is credential theft from cloud metadata services when Ollama runs on cloud-hosted infrastructure.
Server-side request forgery in Label Studio through 1.23.0 allows authenticated users to route outbound webhook requests to RFC 1918 private addresses and cloud instance metadata endpoints (e.g., 169.254.169.254), bypassing network segmentation controls. By creating a webhook that targets an internal service and enabling payload transmission, an attacker can probe internal infrastructure topology and exfiltrate annotation data to attacker-controlled destinations in the same operation. No public exploit exists at time of analysis, but the patch commit confirms the affected code path in label_studio/webhooks/utils.py and the fix extends SSRF controls to S3 endpoint validation as well.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authenticated cluster user to redirect the admission controller's privileged HTTP client to cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal ClusterIP services, and loopback addresses by injecting malicious URLs through JMESPath variable substitution in ClusterPolicy `apiCall.service.url` definitions. Critically, this is non-blind SSRF: response bodies are reflected back to the attacker through admission error messages visible in kubectl output, enabling direct credential and data exfiltration in a single API call. A fully functional proof-of-concept is published in GHSA-qr4g-8hrp-c4rw; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.
Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
Server-Side Request Forgery and structured file disclosure in oasdiff-action prior to version 0.0.51 allows unauthenticated remote attackers to make the GitHub Actions runner fetch arbitrary URLs or read filesystem paths by embedding malicious `$ref` entries in an attacker-controlled OpenAPI spec. The vulnerability is directly exploitable via fork pull requests on public repositories, requiring no interaction from maintainers beyond the normal CI workflow execution. No public exploit has been identified, but the fix PRs (128-130) provide a clear technical blueprint of the attack surface.
Cross-tenant tool execution in MCPHub before v1.0.30 allows any authenticated non-admin user to invoke tools on MCP servers owned by other tenants, bypassing the ownership enforcement that correctly gates list views and configuration edits. Because each registered MCP server runs with the capabilities and credentials of its owner - filesystem access, cloud API keys, HTTP-fetch tools - an attacker with any valid session can exfiltrate victim-owned secrets (demonstrated: /etc/passwd, user secrets) and trigger SSRF against internal services using the victim server's context. No public exploit code is independently circulating at time of analysis, but the GitHub advisory documents the attack technique, and the low complexity makes exploitation straightforward for any authenticated account holder.
MCPHub's SSRF guard can be circumvented by authenticated users who supply MCP server URLs containing IPv6 transition-format addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001::/32) that encode private IPv4 addresses, allowing requests to internal infrastructure the guard was designed to block. Versions prior to 1.0.32 are affected; the custom isBlockedIpv6 function in src/utils/ssrf.ts omits checks for these three address families. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Vendor-released patch is available in v1.0.32 per GitHub advisory GHSA-pr4x-3pc7-2fhw.
Server-Side Request Forgery in MCPHub prior to v1.0.32 allows any authenticated non-admin user to register an arbitrary server URL, coercing the hub into issuing outbound HTTP requests with no egress filtering against loopback, RFC1918, or link-local 169.254.0.0/16 ranges. Via the OpenAPI proxy path, the full HTTP response body is reflected back to the caller, enabling exfiltration of data from internal services including cloud metadata endpoints; via SSE and streamable-HTTP transports, the requests are sent blind, enabling internal port scanning and service triggering. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to reach cloud metadata services and internal HTTP endpoints by supplying publicly resolvable hostnames that map to private IP addresses. The private-address guard - intended to block RFC 1918 and metadata service IPs - is only enforced when the service runs inside Google Cloud, leaving all other deployment environments (AWS, Azure, on-premises) completely unprotected by this control. Successful exploitation in cloud-hosted deployments can yield instance metadata including IAM credentials and access tokens. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.
Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.
Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.
Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.
SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Server-Side Request Forgery in Apify actors-mcp-server allows any MCP caller to make the server fetch arbitrary internal URLs, including cloud instance metadata endpoints, exposing IAM credentials. The get-html-skeleton tool's URL validation in src/tools/common/get_html_skeleton.ts accepted any syntactically valid http/https URL without inspecting the destination hostname or resolved address, permitting requests to loopback, link-local, and RFC 1918 ranges. The CVSS 4.0 score of 8.7 with PR:N reflects unauthenticated exploitation; no public exploit is identified at time of analysis, and the issue is resolved in version 0.9.12 by removing the tool entirely.
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.
Server-side request forgery (SSRF) in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory allows an authenticated gateway administrator to specify arbitrary Spring Resource URLs as the proto descriptor location, causing the gateway to fetch attacker-controlled internal or external resources. Affected versions span the 3.x through 5.x release trains (CPE: cpe:2.3:a:vmware:spring_cloud_gateway). A successful exploit enables the gateway host to be weaponized as an HTTP pivot into internal network services, with confidentiality and integrity impact on systems beyond the gateway boundary (S:C). No public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in JetLinks Community 2.11 lets attackers abuse the device metadata import endpoint (/device/instance/{productId}/property-metadata/import) to coerce the server into issuing arbitrary outbound requests. Because the platform sits at the IoT control layer, this can be used to reach internal-only services, cloud metadata endpoints, and other network-segment resources normally shielded from the internet. A public write-up/POC exists (GitHub) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low (0.14%) and it is not on CISA KEV, so no public exploit identified at time of analysis as active exploitation.
Server-side request forgery in Zyplayer-Doc version 1.0.0 and earlier lets remote unauthenticated attackers coerce the server into issuing arbitrary outbound requests through the WikiPageWebService.download() function. Because the wiki page download feature fetches attacker-controlled URLs without validation, an attacker can reach internal-only services, cloud metadata endpoints, and other back-end systems the server can see. Publicly available exploit code exists (a GitHub write-up), CVSS is rated 9.1, and SSVC flags the flaw as automatable with total technical impact, though it is not listed in CISA KEV.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Server-side request forgery in OneUptime's webhook delivery subsystem allows an authenticated project member to bypass the SSRF protection filter by supplying an IPv4-mapped IPv6 address literal such as [::ffff:127.0.0.1], directing the server to connect to loopback services, private network ranges, or cloud metadata endpoints. All OneUptime versions prior to 12.0.7 are affected; the underlying HTTP client treats the mapped form as the embedded IPv4 address, and the webhook response is returned to the attacker. No public exploit has been identified at time of analysis, but the bypass technique is well-documented in SSRF filter evasion literature and requires no special tooling.
Server-Side Request Forgery in mcp-fetch through version 1.6.3 allows unauthenticated attackers who can influence model tool arguments to bypass the SSRF guard entirely and reach loopback, private, and link-local network endpoints including cloud instance metadata services. The bypass exploits a parsing gap: the guard tests the bracketed IPv6 literal string such as [::1] against Node.js's net.isIP(), which returns zero for bracketed input, causing the private-address branch to be skipped; the HTTP client later strips the brackets and connects normally. A secondary flaw in isPrivateIPv6 - no handling of the ::ffff: IPv4-mapped prefix - provides an independent bypass path for IPv4 targets expressed in mapped form. No public exploit code or CISA KEV listing exists at time of analysis, though a public issue report documenting the flaw is open on the upstream repository.
Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.
Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.
Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.
Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to coerce the server into issuing arbitrary HTTP requests to internal or adjacent network resources, resulting in high-impact information disclosure. The CVSS scope-change flag (S:C) confirms that exploitation can expose resources beyond the SharePoint application boundary - including internal APIs, metadata services, or intranet hosts - making this a meaningful lateral-movement enabler despite its read-only impact. No public exploit code has been identified at time of analysis, and EPSS at 0.86% (56th percentile) suggests limited opportunistic exploitation so far.
Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.
Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.
Unauthenticated server-side request forgery in MindsDB through 26.1.0 allows remote attackers to coerce the platform's web crawler handler into fetching arbitrary attacker-supplied URLs. The root cause is a default-empty allowlist in CrawlerTable.list (web_handler.py lines 50-65), meaning MindsDB ships with no URL restrictions enforced, enabling direct access to internal network services and cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). No public exploit has been confirmed at time of analysis, but VulnCheck published a detailed advisory with precise source-code references, lowering the bar to exploitation significantly.
Server-side request forgery in SQL Chat (the open-source sqlchat AI database client) lets remote unauthenticated attackers abuse four API endpoints (including /api/connection/execute and /api/connection/test) that accept client-supplied database connection parameters and run arbitrary SQL against any attacker-named host. Because no authentication is enforced, an attacker can point the server at internal databases, enumerate schemas, execute queries, and pivot through the SQL Chat host into otherwise unreachable network segments. No public exploit identified at time of analysis, though the affected source files and a VulnCheck advisory pinpoint the exact vulnerable code.
Server-side request forgery in Webstudio through 0.296.0 lets unauthenticated remote attackers abuse the /cgi/image, /cgi/video, and /cgi/asset proxy routes to fetch attacker-chosen URLs whenever the RESIZE_ORIGIN environment variable is unset. Because the proxy blindly forwards supplied URLs, an attacker can read cloud instance metadata (e.g. IMDS credentials), reach internal-only services, and map the instance's private network. Reported by VulnCheck with a public advisory; no public exploit code or CISA KEV listing is present at time of analysis.
SSRF, XXE and denial of service exposure arise in libxml2 before 2.15.4 because xmlXIncludeProcess and xmlXIncludeProcessTree fail to propagate the document's parseFlags down to the parser contexts they create for XInclude resolution. When parseFlags are dropped, protective options such as XML_PARSE_NONET stop being enforced, so an attacker-supplied document containing an external xi:include href can force outbound network fetches through the application's resource loader — enabling server-side request forgery, external entity injection, or a hang driven by an intentionally slow remote resource. Exploitation requires an application that enables XInclude and relies on XML_PARSE_NONET (typically with a custom resource loader); no public exploit code has been identified and EPSS is very low at 0.16% (6th percentile), with no CISA KEV listing.
Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.
Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.
Server-side request forgery in IBM ContextForge MCP Gateway (versions ≤ v1.0.8) lets an authenticated remote attacker induce the gateway to issue outbound requests to attacker-chosen destinations, exposing sensitive information from systems reachable from the gateway's network position; the vendor rates it 9.6, while our independent assessment scores it 8.0 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) because exploitation requires both a valid authenticated session and attacker-controlled DNS with a winning re-resolution timing window. No public exploit code has been identified at time of analysis and there is no KEV listing; EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity. A vendor patch is available via IBM's advisory, and upgrading past v1.0.8 remediates.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to probe internal network infrastructure and cloud metadata services by exploiting a redirect-validation gap in the URL fetching pipeline. The service validates URLs on initial submission but fails to re-validate the destination after HTTP redirects, enabling attackers to pivot from an attacker-controlled public URL to cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254) or RFC-1918 internal addresses, with the response body returned to the attacker. No public exploit code has been independently confirmed at time of analysis, though a VulnCheck advisory and a public GitHub issue (jina-ai/reader#1252) detail the flaw.
Server-side request forgery and model spoofing in lm-sys FastChat let unauthenticated remote attackers register arbitrary workers via the controller's /register_worker endpoint, which performs no authentication. By registering a malicious worker address under a legitimate model's name, an attacker can silently intercept user prompts, uploaded images, and model responses, or coerce the controller into probing internal network ports across the worker mesh. No public exploit identified at time of analysis; the issue was reported by VulnCheck and CVSS 4.0 is scored 9.3.
Server-side request forgery in Nightingale (n9e), the open-source observability platform by ccfos, allows authenticated users of the http_fetch AI-agent tool to bypass the platform's SSRF guard by encoding forbidden IPv4 addresses using 6to4, NAT64, or deprecated site-local IPv6 representations. The isPublicIP function in aiagent/tools/http.go only unwraps standard ::ffff:a.b.c.d IPv4-mapped IPv6 addresses before applying the forbidden-range check, leaving 2002::/16 (6to4), 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64), and fec0::/10 (site-local) unrecognized and passable as 'public'. On dual-stack or NAT64-enabled cloud hosts, this allows an attacker to reach the cloud instance-metadata endpoint (169.254.169.254) or internal services and exfiltrate IAM credentials or sensitive configuration. No public exploit code has been identified at time of analysis.
Unauthenticated SSRF in MegaParse 0.0.55 allows any remote attacker to make the server issue arbitrary HTTP requests by supplying attacker-controlled URLs to the POST /v1/url endpoint, with full responses returned in the JSON reply. Because no authentication is required and the endpoint fetches URLs server-side without restriction, attackers can pivot to cloud provider metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-routable services that are reachable from the MegaParse host. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack surface is trivially exploitable against any internet-exposed deployment.
Server-side request forgery in ms-swift 4.5.2 allows unauthenticated remote attackers to weaponize the server's multimodal media fetching logic against internal infrastructure. The OpenAI-compatible deploy API accepts image_url, audio_url, and video_url parameters that are passed to vision_utils.py without URL validation or redirect filtering, enabling arbitrary outbound requests to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and network-adjacent services. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network-accessible attack surface and high confidentiality impact make this a significant risk for any internet-exposed ms-swift deployment.
Server-side request forgery in camel-ai OWL's DocumentProcessingToolkit exposes internal network resources to unauthenticated remote attackers across all tracked versions. The `extract_document_content` tool fetches caller-supplied URLs with no scheme, host, or IP allowlist, enabling attackers to pivot through the agent server to reach cloud metadata endpoints, internal APIs, or other SSRF-reachable services. The attack is delivered via prompt injection - malicious URL directives embedded in content processed by the OWL agent - with SSRF responses surfaced directly in the agent's context window, potentially leaking credentials or internal topology. No public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. No public exploit identified at time of analysis, but the flaw is remotely reachable against default deployments and was independently reported by VulnCheck.
Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.
Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.
Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.
Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.
Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis.
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Server-Side Request Forgery in Apache Allura through version 1.20.0 lets attackers abuse the project webhook feature to coerce the server into issuing arbitrary outbound requests, enabling access to internal-only services and cloud metadata endpoints. The flaw is fixed in 1.21.0. No public exploit is identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating no observed mass-exploitation pressure despite the high CVSS.
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.
Server-side request forgery in OpenStack Glance before 32.0.1 allows authenticated cloud tenants to probe internal network endpoints by registering HTTP image locations that bypass host-restriction filtering. The location API - both POST /v2/images/{id}/locations and the PATCH API when show_multiple_locations is enabled - validates only the URL scheme and ignores the import_filtering_opts host allow-list that guards the web-download path, permitting requests to addresses such as the cloud metadata service at 169.254.169.254. A low-privileged tenant can then retrieve the server's response by downloading the image, potentially exposing ephemeral instance credentials or bootstrap secrets. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.0 with SC:H reflects genuine cross-boundary credential exposure risk on affected deployments.
Server-Side Request Forgery in Ollama versions 0.30.0 through 0.33.2 allows unauthenticated remote attackers to redirect the Ollama server's blob-download requests to arbitrary internal hosts, including cloud metadata endpoints such as the AWS instance metadata service. The flaw exists in the tensor-layer model pulling code path (x/transfer/download.go), where HTTP redirect destinations are not validated against an allowlist or the originating registry host. With no public exploit identified at time of analysis, the primary real-world impact is credential theft from cloud metadata services when Ollama runs on cloud-hosted infrastructure.
Server-side request forgery in Label Studio through 1.23.0 allows authenticated users to route outbound webhook requests to RFC 1918 private addresses and cloud instance metadata endpoints (e.g., 169.254.169.254), bypassing network segmentation controls. By creating a webhook that targets an internal service and enabling payload transmission, an attacker can probe internal infrastructure topology and exfiltrate annotation data to attacker-controlled destinations in the same operation. No public exploit exists at time of analysis, but the patch commit confirms the affected code path in label_studio/webhooks/utils.py and the fix extends SSRF controls to S3 endpoint validation as well.
Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.
Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.
Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.
SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authenticated cluster user to redirect the admission controller's privileged HTTP client to cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal ClusterIP services, and loopback addresses by injecting malicious URLs through JMESPath variable substitution in ClusterPolicy `apiCall.service.url` definitions. Critically, this is non-blind SSRF: response bodies are reflected back to the attacker through admission error messages visible in kubectl output, enabling direct credential and data exfiltration in a single API call. A fully functional proof-of-concept is published in GHSA-qr4g-8hrp-c4rw; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.
Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
Server-Side Request Forgery and structured file disclosure in oasdiff-action prior to version 0.0.51 allows unauthenticated remote attackers to make the GitHub Actions runner fetch arbitrary URLs or read filesystem paths by embedding malicious `$ref` entries in an attacker-controlled OpenAPI spec. The vulnerability is directly exploitable via fork pull requests on public repositories, requiring no interaction from maintainers beyond the normal CI workflow execution. No public exploit has been identified, but the fix PRs (128-130) provide a clear technical blueprint of the attack surface.
Cross-tenant tool execution in MCPHub before v1.0.30 allows any authenticated non-admin user to invoke tools on MCP servers owned by other tenants, bypassing the ownership enforcement that correctly gates list views and configuration edits. Because each registered MCP server runs with the capabilities and credentials of its owner - filesystem access, cloud API keys, HTTP-fetch tools - an attacker with any valid session can exfiltrate victim-owned secrets (demonstrated: /etc/passwd, user secrets) and trigger SSRF against internal services using the victim server's context. No public exploit code is independently circulating at time of analysis, but the GitHub advisory documents the attack technique, and the low complexity makes exploitation straightforward for any authenticated account holder.
MCPHub's SSRF guard can be circumvented by authenticated users who supply MCP server URLs containing IPv6 transition-format addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001::/32) that encode private IPv4 addresses, allowing requests to internal infrastructure the guard was designed to block. Versions prior to 1.0.32 are affected; the custom isBlockedIpv6 function in src/utils/ssrf.ts omits checks for these three address families. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Vendor-released patch is available in v1.0.32 per GitHub advisory GHSA-pr4x-3pc7-2fhw.
Server-Side Request Forgery in MCPHub prior to v1.0.32 allows any authenticated non-admin user to register an arbitrary server URL, coercing the hub into issuing outbound HTTP requests with no egress filtering against loopback, RFC1918, or link-local 169.254.0.0/16 ranges. Via the OpenAPI proxy path, the full HTTP response body is reflected back to the caller, enabling exfiltration of data from internal services including cloud metadata endpoints; via SSE and streamable-HTTP transports, the requests are sent blind, enabling internal port scanning and service triggering. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.
SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.
Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to reach cloud metadata services and internal HTTP endpoints by supplying publicly resolvable hostnames that map to private IP addresses. The private-address guard - intended to block RFC 1918 and metadata service IPs - is only enforced when the service runs inside Google Cloud, leaving all other deployment environments (AWS, Azure, on-premises) completely unprotected by this control. Successful exploitation in cloud-hosted deployments can yield instance metadata including IAM credentials and access tokens. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).
Server-side request forgery in the Total Processing card payments plugin for WooCommerce (all versions through 7.3) lets unauthenticated remote attackers control the destination of the plugin's server-side payment-verification request. Because the plugin neither validates the user-supplied path nor authenticates the gateway's response, an attacker can redirect the verification call to a host they control to harvest the merchant's payment-gateway credentials and forge a fake success response that marks arbitrary WooCommerce orders as paid. Publicly available exploit code exists (reported by WPScan); it is not listed in CISA KEV and EPSS is low (0.14%, 3rd percentile).
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.
Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.
Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.
Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.
Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.
SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.
Server-side request forgery in the GitLab AI Gateway (Duo Agent Platform) lets an authenticated user redirect outbound model requests to an attacker-controlled endpoint by supplying a crafted inline flow configuration that overrides the HTTP Host header, exfiltrating Google Cloud Vertex service credentials and private signing keys. It affects AI Gateway 18.10 through 19.0.11, 19.1 through 19.1.6, and 19.2 through 19.2.1. Publicly available exploit code exists (HackerOne #3945100); EPSS is low at 0.19% and it is not in CISA KEV.
Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.
Server-Side Request Forgery in Apify actors-mcp-server allows any MCP caller to make the server fetch arbitrary internal URLs, including cloud instance metadata endpoints, exposing IAM credentials. The get-html-skeleton tool's URL validation in src/tools/common/get_html_skeleton.ts accepted any syntactically valid http/https URL without inspecting the destination hostname or resolved address, permitting requests to loopback, link-local, and RFC 1918 ranges. The CVSS 4.0 score of 8.7 with PR:N reflects unauthenticated exploitation; no public exploit is identified at time of analysis, and the issue is resolved in version 0.9.12 by removing the tool entirely.
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.
Insufficient input validation in Spring Security's OAuth2 Authorization Server module (versions 7.0.0-7.0.4) allows an attacker holding a valid Initial Access Token to register a malicious OAuth2 client with crafted metadata fields via the Dynamic Client Registration endpoint. Depending on server configuration and how the metadata is subsequently rendered or fetched, the impact spans Stored XSS (targeting administrator sessions), Privilege Escalation (through insufficiently constrained scopes or grant types), or SSRF against internal infrastructure. No public exploit code or CISA KEV listing exists at time of analysis, but the SSVC framework rates the technical impact as total, warranting priority remediation for any deployment with Dynamic Client Registration explicitly enabled.
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.
Server-side request forgery (SSRF) in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory allows an authenticated gateway administrator to specify arbitrary Spring Resource URLs as the proto descriptor location, causing the gateway to fetch attacker-controlled internal or external resources. Affected versions span the 3.x through 5.x release trains (CPE: cpe:2.3:a:vmware:spring_cloud_gateway). A successful exploit enables the gateway host to be weaponized as an HTTP pivot into internal network services, with confidentiality and integrity impact on systems beyond the gateway boundary (S:C). No public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in JetLinks Community 2.11 lets attackers abuse the device metadata import endpoint (/device/instance/{productId}/property-metadata/import) to coerce the server into issuing arbitrary outbound requests. Because the platform sits at the IoT control layer, this can be used to reach internal-only services, cloud metadata endpoints, and other network-segment resources normally shielded from the internet. A public write-up/POC exists (GitHub) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low (0.14%) and it is not on CISA KEV, so no public exploit identified at time of analysis as active exploitation.
Server-side request forgery in Zyplayer-Doc version 1.0.0 and earlier lets remote unauthenticated attackers coerce the server into issuing arbitrary outbound requests through the WikiPageWebService.download() function. Because the wiki page download feature fetches attacker-controlled URLs without validation, an attacker can reach internal-only services, cloud metadata endpoints, and other back-end systems the server can see. Publicly available exploit code exists (a GitHub write-up), CVSS is rated 9.1, and SSVC flags the flaw as automatable with total technical impact, though it is not listed in CISA KEV.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Server-side request forgery in OneUptime's webhook delivery subsystem allows an authenticated project member to bypass the SSRF protection filter by supplying an IPv4-mapped IPv6 address literal such as [::ffff:127.0.0.1], directing the server to connect to loopback services, private network ranges, or cloud metadata endpoints. All OneUptime versions prior to 12.0.7 are affected; the underlying HTTP client treats the mapped form as the embedded IPv4 address, and the webhook response is returned to the attacker. No public exploit has been identified at time of analysis, but the bypass technique is well-documented in SSRF filter evasion literature and requires no special tooling.
Server-Side Request Forgery in mcp-fetch through version 1.6.3 allows unauthenticated attackers who can influence model tool arguments to bypass the SSRF guard entirely and reach loopback, private, and link-local network endpoints including cloud instance metadata services. The bypass exploits a parsing gap: the guard tests the bracketed IPv6 literal string such as [::1] against Node.js's net.isIP(), which returns zero for bracketed input, causing the private-address branch to be skipped; the HTTP client later strips the brackets and connects normally. A secondary flaw in isPrivateIPv6 - no handling of the ::ffff: IPv4-mapped prefix - provides an independent bypass path for IPv4 targets expressed in mapped form. No public exploit code or CISA KEV listing exists at time of analysis, though a public issue report documenting the flaw is open on the upstream repository.
Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.