Server-Side Request Forgery

Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP requests through the /tools/site-checker endpoint, with no authentication, IP allowlisting, or SSRF mitigation in place. The endpoint's url query parameter is passed directly to fetchWithRedirects() in apps/api/src/controllers/tools.controller.ts, allowing attackers to reach cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), enumerate internal ports, and retrieve response content including status codes, page sizes, and parsed HTML metadata. A secondary leakage path via getIPInfo() exfiltrates internal IP addresses to a third-party service, exposing network topology data beyond the attacker's direct channel. No public exploit code has been identified at time of analysis.

Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.

Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.

Server-side request forgery in PlaywrightCapture's favicon retrieval function allows a remote attacker to cause the PlaywrightCapture host to issue HTTP requests to internal or loopback-addressed services by exploiting a redirect-bypass in the aiohttp HTTP client. When the `only_global_lookup` configuration is active, the library validates the user-supplied favicon URL before the first request but does not re-validate URLs generated by automatic HTTP redirects, allowing a publicly reachable attacker-controlled URL to redirect to restricted destinations such as 127.0.0.1 or internal network services. Depending on what internal HTTP services are reachable from the PlaywrightCapture host and how favicon response content is surfaced, this enables internal network probing and potential information disclosure. A patch is available via the upstream Lookyloo repository; no active exploitation has been identified.

Fleet controller's Helm template preprocessing exposes cluster metadata and internal DNS topology to any user with write access to a GitRepo-tracked repository, via a server-side request forgery path that abuses name resolution. Affected releases span all active branches from 0.12.0 through 0.16.0, with patched builds released across each branch. The DNS-based exfiltration channel is notable because it can remain effective in environments where outbound TCP/UDP egress is otherwise restricted, making standard network perimeter controls insufficient as a compensating measure.

Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure.

Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.

Server-Side Request Forgery in Dell PowerProtect Data Manager's REST API (versions 20.2.0.0 and below) allows high-privileged remote attackers to induce the server to issue unauthorized outbound HTTP requests to internal or adjacent network resources. The CVSS scope-change metric (S:C) signals that successful exploitation can reach infrastructure beyond the PowerProtect instance itself, enabling partial internal-network reconnaissance even from a single compromised admin session. No public exploit code exists and no active exploitation has been confirmed; Dell has issued multi-vulnerability advisory DSA-2026-368 addressing this flaw.

Credential exfiltration via SSRF in LiteLLM proxy (AI Gateway) prior to versions 1.88.6 and 1.96.2 allows any authenticated proxy user to redirect outbound LLM provider calls to an attacker-controlled endpoint, causing the proxy to transmit its operator-configured API keys and other secrets to that destination. Vulnerable routing parameters - api_base, base_url, model_list, fallbacks, and litellm_credential_name - could be injected through nested request fields, path values, and bracket-notation form data that incomplete validation across five proxy modules failed to intercept. No public exploit code has been identified at time of analysis; vendor-released patches are confirmed at versions 1.88.6 and 1.96.2.

Server-Side Request Forgery with full response exfiltration in Open edX Platform's Studio CMS video download endpoint allows authenticated course staff to pivot from the application server into internal networks. A course staff user submits an attacker-controlled URL in the `files[].url` parameter; the CMS backend unconditionally fetches the target via `requests.get(url, allow_redirects=True)` and packages the raw response bytes into a ZIP returned to the caller. Redirect chaining is enabled and no timeout is enforced on the fetch path, enabling blind SSRF amplification and potential cloud-metadata credential theft. No public exploit or active exploitation has been identified at time of analysis. The fix, committed at 00b7c3c, restricts fetches to URL allowlisted from the course's own VAL-registered video encodings.

Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. No active exploitation or public proof-of-concept has been identified; a vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-097.

Server-Side Request Forgery in the Broken Link Checker WordPress plugin (WPMU Dev, versions ≤ 2.4.14) allows high-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests from its editor component. The CVSS scope-change flag (S:C) indicates the forged requests can reach resources outside the WordPress application boundary, such as cloud instance metadata endpoints or internal network services. No public exploit has been identified at time of analysis.

Server-side request forgery in Eclipse Ditto's Things service allows authenticated users with WRITE permission on a Thing to force the service to issue arbitrary HTTP GET requests to any host reachable from within the deployment's internal network. The vulnerability arises because the Things service fetches WoT ThingModel documents from attacker-supplied URLs in the Thing or Feature `definition` field without validating the target host, without re-validating redirect targets, and without enforcing a redirect hop limit. Attackers can leverage cloud instance-metadata endpoints (e.g., AWS IMDS at 169.254.169.254) and exploit differing HTTP error responses to enumerate internal services. No public exploit or CISA KEV entry exists at time of analysis.

Server-side request forgery in Mailpit's link-checking and proxy functionality allows unauthenticated remote attackers to bypass the IsInternalIP deny list and reach restricted internal network destinations. The deny list in net.go failed to include the Azure WireServer address (168.63.129.16/32) and the RFC 2765/6145 IPv4-translated IPv6 prefix (::ffff:0:0:0/96), enabling DNS rebinding-style attacks where attacker-controlled hostnames resolve to these unblocked addresses. When Mailpit is deployed in Azure environments, this specifically enables access to the platform metadata channel used by the Azure host agent. No public exploit or KEV listing identified at time of analysis.

Server-side request forgery in the HPE AOS-CX web-based management interface allows an authenticated attacker with low-privilege credentials to force the switch to issue arbitrary internal HTTP requests, exposing the internal network topology and enabling limited modification of sensitive information. The vulnerability carries a Scope:Changed CVSS designation because the forged requests cross the trust boundary from the management plane into internal infrastructure the attacker cannot otherwise reach. This is the fifth CVE bundled in HPE advisory hpesbnw05134en_us alongside more severe issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string RCE (CVE-2026-73782, CVSS 8.8). No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis.

Server-side request forgery in Wyoming before 1.10.2 allows unauthenticated network-accessible attackers to redirect outbound connections from the server to arbitrary attacker-chosen hosts. The HTTP API accepted an unvalidated `uri` query parameter across multiple endpoints - including `/api/info`, `/api/speech-to-text`, and `/api/text-to-speech` - enabling full override of the server-configured backend URI with arbitrary `tcp://` or `unix://` targets. No public exploit has been identified at time of analysis, but the attack requires only a crafted HTTP request with no authentication.

Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. No public exploit has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available as v0.0.98.

Server-side request forgery in Kyverno's APICall feature (all versions before 1.16.2) enables any user holding namespace-level Policy creation rights to weaponize Kyverno's cluster-wide, high-privilege ServiceAccount as a confused deputy - directing it to issue HTTP requests to arbitrary internal endpoints including cloud IMDS at 169.254.169.254. Responses, potentially containing other tenants' database passwords, API keys, and cloud IAM role credentials, are surfaced in the PolicyReport and are readable by the attacking tenant, completely collapsing multi-tenant isolation. No public exploit has been identified at time of analysis, though the attack path is straightforward and the impact in shared Kubernetes clusters is severe.

Server-side request forgery in Kyverno's Service Call feature (versions before v1.13.4) allows any cluster user holding ClusterPolicy creation rights to exfiltrate arbitrary Kubernetes resource data - including Secrets - by directing policy apiCall requests to an attacker-controlled external server. The vulnerability stems from a missing URL validation that permits the apiCall/service block, documented for in-cluster services, to resolve and POST data to internet-accessible endpoints. Publicly available exploit code exists in the form of a working PoC ClusterPolicy published in the GHSA advisory; no active exploitation is confirmed via CISA KEV.

Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.

Server-side request forgery in Hyperledger Firefly up to 1.4.0 allows unauthenticated remote attackers to manipulate the webhook subscription URL parameter, causing the Firefly server to issue arbitrary HTTP requests to internal or otherwise inaccessible network resources. The vulnerability resides in the ValidateOptions function within the webhook subsystem (internal/events/webhooks/webhooks.go) and is exploitable without authentication or user interaction per the CVSS 4.0 AV:N/PR:N/UI:N vector. A public proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch or response has been identified at time of analysis.

Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.

Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV.

Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on the 5.x line) allows network-accessible attackers to bypass the trusted_uri allowlist and reach arbitrary internal endpoints by exploiting PHP's default redirect-following behavior. The security policy's isTrustedUri() check validates only the initial URL; when file_get_contents() silently follows an HTTP redirect placed on a trusted host, the request lands on an attacker-chosen internal target, enabling SSRF to services such as cloud metadata endpoints or internal APIs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Server-side request forgery in sdcb chats up to version 1.12.0 allows authenticated remote users to cause the application server to issue arbitrary HTTP requests to attacker-controlled targets via the fetch-tools endpoint in McpController. The vulnerable code path is in src/BE/web/Controllers/Users/Mcps/McpController.cs and accepts user-supplied URLs without adequate validation. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch.

Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists.

Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts.

Server-side request forgery in yaojingang GEOFlow up to 2.1.0 allows high-privileged authenticated attackers to make the application server issue arbitrary outbound HTTP requests by supplying a crafted value to the endpoint_url argument of DistributionController.isValidHttpEndpoint in GenericHttpEndpointResolver.php. The vulnerability carries a very low CVSS 4.0 score of 2.0 due to the PR:H requirement, limiting realistic attacker population to those already holding elevated application credentials. A public exploit has been disclosed via GitHub issue #60, though no active exploitation has been confirmed by CISA KEV.

Server-side request forgery in PowerJob up to version 5.1.2 allows unauthenticated remote attackers to issue arbitrary server-originated requests via the MuConnectionManager.getOrCreateConnection function exposed through the Transport Endpoint in TestController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and description), and no vendor patch is available - the project was notified via GitHub issue but has not responded. Successful exploitation can be used to probe internal services, access cloud instance metadata endpoints, or exfiltrate credentials from the server's internal network.

Server-Side Request Forgery (SSRF) in Apache Shiro's Jakarta EE integration module (shiro-jakata-ee) enables a low-privileged authenticated user to steer server-initiated POST requests to an attacker-controlled host and transmit attacker-controlled data. Versions 2.0.0-alpha-0 through 3.0.0 of the shiro-jakata-ee artifact are affected, but only when the Jakarta EE integration module is deployed - the 1.x line and non-Jakarta-EE deployments are not vulnerable. No public exploit has been identified at time of analysis, and vendor-released patch 3.0.1 is available as of 2026-08-24.

Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.

Server-side request forgery in Memos through 0.30.0 allows unauthenticated remote attackers to make the application's link-metadata fetcher issue HTTP requests to hosts in the 100.64.0.0/10 carrier-grade NAT address space, a range the application's IP blocklist incorrectly omits. The server returns page titles and HTML meta descriptions from targeted internal hosts, enabling partial reconnaissance of CGNAT-addressed infrastructure. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.

Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.

Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.

Server-Side Request Forgery in wallabag 2.x through 2.6.14 enables authenticated users to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via a maliciously crafted article title or content field that is processed during PDF export. The scope change in the CVSS vector (S:C) reflects that the SSRF escapes the wallabag application boundary and can reach backend services, cloud metadata endpoints, or internal network hosts invisible to the attacker directly. A separate full-disclosure post references this same advisory with a higher CVSS score of 8.5 and also mentions a Stored XSS vector, suggesting the attack surface may be broader than the NVD 6.4 score implies. No public exploit identified at time of analysis.

Server-side request forgery in WatchGuard Dimension's Email Server Test configuration feature enables authenticated privileged attackers to probe and enumerate network services on adjacent network segments. The vulnerability stems from insufficient validation of server-initiated outbound requests, allowing the Dimension management platform to be weaponized as a network scanning proxy. No public exploit code has been identified at time of analysis, and the attack requires high-privilege credentials, materially limiting realistic exposure.

Server-side request forgery in WatchGuard Dimension's Remote Backup Connection Test configuration feature allows authenticated privileged users to enumerate exposed network services on adjacent systems. The CVSS 4.0 score of 5.3 reflects confined impact - no direct compromise of the Dimension host itself, but meaningful secondary-system reconnaissance capability. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-side request forgery in WatchGuard Dimension's FTP Server Test configuration feature allows a privileged authenticated attacker to probe and enumerate network services on adjacent network systems. The vulnerability affects all tracked versions of WatchGuard Dimension (CPE wildcard) and is limited to subsequent-system confidentiality impact - specifically service discovery on internal or adjacent hosts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Blind server-side request forgery in WatchGuard Dimension's Database Server Test configuration feature allows an authenticated privileged attacker to enumerate network services on adjacent systems by exploiting observable timing or response discrepancies (CWE-208). The scope of impact extends beyond the Dimension host itself to adjacent network segments, enabling internal network reconnaissance without direct access to those systems. No public exploit is identified at time of analysis, and the high privilege requirement substantially limits the realistic attacker pool.

Server-side request forgery in scrapling-fetch-mcp versions through 0.2.2 allows an authenticated user of an MCP-enabled AI assistant to supply arbitrary URL schemes - such as file://, gopher://, or dict:// - to the s_fetch_page and s_fetch_pattern tool functions, causing the server to issue requests to internal or local resources on behalf of the attacker. The root cause is the absence of any URL scheme validation before passing user-controlled input to the underlying browse_url call in _fetcher.py. No public exploit code or active exploitation has been identified; version 0.2.3 patches the issue.

Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.

Incomplete NAT64 prefix filtering in CC: Tweaked prior to 1.120.0 allows any Lua-capable Minecraft player on a dual-stack server to bypass SSRF protections and reach loopback, RFC 1918, cloud metadata, or internal API endpoints. The flaw resides in AddressPredicate.java, which correctly blocks the RFC 6052 Well-Known NAT64 prefix (64:ff9b::/96) but omits the RFC 8215 Local-Use prefix (64:ff9b:1::/48), enabling requests via http.request or http.websocket to mapped internal IPv4 addresses. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires a non-default dual-stack NAT64 deployment.

Server-side request forgery in AVideo before 24.0 allows unauthenticated network attackers to bypass SSRF protections in the isSSRFSafeURL function by encoding private IPv4 targets inside NAT64, 6to4, or Teredo IPv6 transition address formats. The LiveLinks proxy endpoint serves as the attack surface, enabling requests to reach internal network services and cloud instance metadata endpoints (e.g., 169.254.169.254 equivalents) that should be unreachable. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, the unauthenticated network vector and patch availability make this a straightforward prioritization for any AVideo operator.

Header type injection in Spring for Apache Kafka's default mapper configuration allows any Kafka producer with access to a consumed topic to inject java.net.InetAddress objects through the spring_json_header_types message header, triggering DNS resolution on the consumer host. All applications using @KafkaListener with the default JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper - spanning versions 2.8.x through 4.1.0 - are affected without any non-default configuration required. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.

Server-side request forgery in ddfourtwo sentry-selfhosted-mcp 0.4.0 allows remote unauthenticated attackers to manipulate the endpoint argument in the raw_sentry_api component, causing the server to issue arbitrary HTTP requests to internal or external hosts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit exists via a GitHub issue report. No patch has been released - the project maintainer has not responded to the coordinated disclosure.

Server-side request forgery in HCL Connections allows a low-privileged, authenticated attacker - operating from or through a compromised internal server - to issue unauthorized outbound requests to internal resources, resulting in limited information disclosure or potential security control bypass. The vulnerability carries a low CVSS base score of 3.7 due to high attack complexity, required user interaction, and unchanged scope, and no public exploit or CISA KEV listing exists at time of analysis. Risk is constrained by the prerequisite of a pre-compromised internal host, making this a meaningful lateral-movement enabler rather than a direct initial-access vector.

DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.

Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.

Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. No public exploit has been identified at time of analysis, and no confirmed KEV listing exists; however, the scope-changing CVSS vector (S:C) reflects that impact crosses trust boundaries from the application into adjacent internal infrastructure.

Server-side request forgery in Ech0 through 4.2.1 (Go-based self-hosted application by lin-snow) allows an authenticated admin to exfiltrate data from internal network services and cloud metadata endpoints by exploiting a DNS resolution bypass in webhook URL validation. The validateWebhookURL function checks only literal IP strings via net.ParseIP(), so hostnames like 169.254.169.254.nip.io pass validation unchallenged and DNS-resolve to private IPs at request time. Publicly available exploit code exists (curl-based PoC in GHSA-r2x7-427f-rq69); no confirmed active exploitation (not in CISA KEV). The CVSS 4.0 score of 5.1 reflects the PR:H prerequisite, which substantially limits real-world exposure.

Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.

Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.

DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.

Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.

Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.

Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.

Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.

Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.

SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.

Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.

Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.

Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.

Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-Side Request Forgery in Lightdash's scheduled delivery webhook feature allows authenticated users to direct the backend server to issue POST requests to private, loopback, and link-local addresses - including cloud instance metadata endpoints. All deployments running versions prior to 1.146.4 are affected; both the Google Chat and Microsoft Teams webhook delivery paths bypass the existing validatePublicHttpUrl sanitization that is correctly applied elsewhere in the codebase. While the upstream response is never relayed to the attacker, the error-vs-success distinction enables internal network probing and, in cloud-hosted deployments, potential access to instance metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-side request forgery in Microsoft Copilot in Azure enables any authenticated Azure user to coerce the service into issuing arbitrary outbound requests, disclosing internal or cloud-infrastructure data back through the Copilot response channel. The CVSS scope-change indicator (S:C) and high confidentiality impact (C:H) suggest the service's privileged network position can be leveraged to reach resources beyond the application boundary - such as Azure Instance Metadata Service endpoints, internal APIs, or adjacent cloud services. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released a server-side patch.

Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.

Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR.

Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administrative role required - to coerce the Manager service into issuing outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This effectively turns the InLong Manager into an open proxy for internal network reconnaissance, enabling access to otherwise firewalled services such as cloud instance metadata endpoints, internal APIs, or database management interfaces. No public exploit has been identified at time of analysis, but the low privilege bar makes this broadly reachable within any deployment that permits shared user access.

Server-side request forgery in ATutor's import functionalities allows an authenticated administrator to coerce the server into issuing HTTP requests to arbitrary internal endpoints, cloud metadata services such as AWS IMDSv1, or local filesystem paths via the file:// URI scheme where PHP URL wrappers are enabled. Only version 2.2.4 has been confirmed vulnerable by CERT.pl researchers; the product is end-of-life with no planned fix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of cloud metadata reachability and EOL status makes compensating controls the only available path.

SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.

Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.

SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.

Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. No public exploit identified at time of analysis, and no CISA KEV listing exists; a patch commit is available upstream.

Server-side request forgery in Omnivore's scanFeedsResolver GraphQL endpoint allows authenticated users to direct the API server to fetch arbitrary internal URLs, bypassing the validateUrl() guard consistently applied elsewhere in the same codebase. Reachable internal endpoints return partial feed metadata (URL, title, description, type) and advertised RSS/Atom link elements; unreachable ports are distinguishable through error differentiation, enabling internal network enumeration. No public exploit has been identified and this vulnerability is not listed in CISA KEV; an upstream patch has been merged as commit c4d7d8562.

Server-Side Request Forgery in PullMD 3.2.0 exposes internal network resources and cloud metadata endpoints through the unauthenticated REST API endpoint GET /api, where the url parameter is passed without validation to the server's HTTP fetch stack. The vulnerability affects multiple fetch paths including the MCP read_url tool, Reddit resolver, and Playwright sidecar, all of which lacked SSRF guards prior to v3.3.0. A public exploit exists (GitHub issue #41), and the changelog confirms that 169.254.169.254 and 100.100.100.200 (AWS/Alibaba cloud metadata) were specifically demonstrated as targets; no active exploitation has been confirmed by CISA KEV.

Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.

Server-Side Request Forgery in Splunk Enterprise and Splunk Secure Gateway allows low-privileged authenticated users to manipulate internal Splunk services via crafted report notification paths. Affected versions span Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.9, 3.9.23, and 3.8.70. An attacker holding any valid Splunk account - excluding admin and power roles - can leverage the unvalidated path handling in Secure Gateway to issue system-authenticated internal requests, potentially disrupting Search Head Cluster state or causing denial of service. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Hardened-mode SSRF protections in the mcp-searxng Node.js MCP server (npm/mcp-searxng < 1.2.1) can be bypassed via three distinct techniques, allowing `web_url_read` to fetch loopback and internal network resources despite `MCP_HTTP_HARDEN=true` being set. The bypasses exploit: unvalidated HTTP redirect chains to internal addresses, the unblocked `0.0.0.0` special address, and IPv4-mapped IPv6 literals that survive Node's WHATWG URL canonicalization intact but defeat regex-based private-address filters. Publicly available proof-of-concept code demonstrates all three bypass paths returning content from a loopback sentinel service; no KEV listing exists at time of analysis.

Server-Side Request Forgery in mcp-searxng's web_url_read tool allows any caller - including an LLM steered via prompt injection - to make the server fetch internal HTTP services and cloud metadata endpoints (e.g., http://169.254.169.254/) and return their contents into the model context. The SSRF guard function assertUrlAllowed exists in the codebase but ships disabled because MCP_HTTP_HARDEN defaults to false, meaning all default deployments of versions prior to 1.2.1 are unprotected. Publicly available exploit code exists, validated on v1.1.0; no CISA KEV listing was present at time of analysis.

DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.

Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.

XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.

Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application server's HTTP client toward loopback and RFC 1918 private-network destinations by supplying arbitrary values in the webhook subscription delivery_address parameter. When a matching fact-change event fires, Stigmem's backend issues an unsolicited HTTP POST to the attacker-specified internal address, enabling interaction with co-located internal services the attacker could not otherwise reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation probability is currently unquantified.

Server-Side Request Forgery in FUXA 1.3.2 and earlier allows authenticated non-admin runtime users to weaponize the FUXA server as an outbound HTTP proxy, reading responses from internal services and cloud metadata endpoints. The vulnerability exists in the device-webapi-request Socket.IO handler, which applies no ownership or allowlist validation to the user-controlled property.address parameter before issuing the request. Patch is available as of version 1.3.3; no public exploit code or CISA KEV listing identified at time of analysis.

SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.