Taskingai
Monthly
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.