Server-Side Request Forgery

Server-side request forgery in jina-ai Reader's Puppeteer-based crawler allows unauthenticated remote attackers to manipulate the `isValidTLD` function to coerce the server into issuing arbitrary HTTP requests to internal or restricted network targets. All deployments up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1 are affected with no vendor-issued patch, as the maintainers did not respond to disclosure. A public proof-of-concept exploit exists (no CISA KEV listing), and the rolling release model means there is no safe pinned version for operators to target.

Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.

SSRF classification bypass in the ip-address npm library (versions 10.1.1-10.2.1) allows network-accessible applications to be deceived into treating internal IP addresses as external. When a caller-supplied CIDR suffix such as /0 is retained during parsing, the isInSubnet() guard short-circuits before any bit comparison, causing every special-use classifier - isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), and others - to return false for internal addresses, while correctForm() still resolves to the real internal target. A publicly available proof-of-concept is included in the GHSA advisory; no CISA KEV listing exists at time of analysis, so active exploitation is not confirmed.

Unauthenticated server-side request forgery in the Pixelavo WordPress plugin before 1.5.4 allows any visitor to inject arbitrary Facebook conversion events using the site administrator's stored Conversions API access token. The plugin registers an AJAX endpoint protected only by a nonce that is emitted in plaintext on every public page load, rendering the nonce trivially obtainable and the endpoint effectively unprotected. Attackers can poison the administrator's Facebook Ads analytics with fabricated conversion data and exhaust the configured API quota, degrading ad targeting and measurement. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.

Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.

Server-Side Request Forgery in Pentestify's PDF export pipeline allows authenticated users to induce the server-side headless browser to issue outbound HTTP GET requests to arbitrary attacker-specified destinations by storing remote URLs in the finding images field or the report client_logo field. All Pentestify installations prior to version 1.1.0 are affected (CPE: cpe:2.3:a:ccyl13:pentestify). No active exploitation has been confirmed (not in CISA KEV, no public POC identified), but the vulnerability enables internal network reconnaissance and cloud metadata endpoint access from the Pentestify server's network context, posing meaningful risk in cloud-hosted or internally-networked deployments.

Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.

Server-side request forgery in WACRM 0.7.0 and earlier allows any authenticated user holding automation privileges to coerce the application server into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. The send_webhook automation action in src/lib/automations/engine.ts was missing a call to the existing isDeliverableUrl SSRF guard that already protected the webhook_endpoints delivery path, creating an inconsistent and exploitable gap. No public exploit code has been independently identified and the vulnerability is not listed in CISA KEV; however, the fix commit and GitHub security advisory are publicly available, substantially lowering the bar for any attacker who has read the diff.

Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.

Server-side request forgery in MaxKB versions 2.0.0 through 2.10.4-lts allows authenticated workspace users to proxy HTTP requests through the application server to internal infrastructure, loopback addresses, link-local networks, and cloud instance metadata endpoints such as the AWS IMDSv1 service. The vulnerable code paths in both template workflow handlers and tool update functions pass caller-supplied download_url and download_callback_url values directly to requests.get protected only by a weak startsWith prefix check, which is insufficient to block hostname-confusion or open-redirect bypasses. No public exploit has been identified at time of analysis, and the upstream fix on the v2 branch has not yet been packaged into a published release.

Server-Side Request Forgery in Boruta (malach-it/boruta_auth versions 2.3.2 through 2.3.6) enables unauthenticated remote attackers to force the OAuth/OpenID authorization server to issue outbound HTTP requests to arbitrary attacker-controlled URIs, including cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal APIs, and RFC 1918 network services. Three distinct code paths - OAuth request_uri handling, OpenID Connect dynamic client registration jwks_uri, and scheduled jwks_uri refresh - all invoke Elixir's Finch HTTP client against caller-supplied URIs with no host allowlist, no private IP rejection, no redirect constraint, and no response size cap. No public exploit has been identified at time of analysis; a vendor patch is available in version 2.3.7.

Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsConfig custom resource to redirect the operator's OAuth token requests to an attacker-controlled endpoint, exposing the tenant's Red Hat SSO client_id and client_secret. The operator's service-account authentication mode unconditionally forwards these credentials to whatever OAuth token URL is configured in the CR, acting as a confused deputy on behalf of the CR editor. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS Scope:Changed metric reflects that the operator process holds credentials inaccessible to the CR editor directly, amplifying impact beyond the initial access tier.

Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.

Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.

Server-Side Request Forgery in Pydantic AI's UI adapter layer (versions 1.65.0-1.105.0 and 2.0.0b1-2.0.0b5) allows unauthenticated network clients to redirect the application server into fetching arbitrary cloud-storage objects using the server's own credentials. UploadedFile references - carrying provider file IDs or cloud-storage URIs such as s3:// or gs:// - submitted via client message history bypass the scheme allowlist applied to ordinary file URLs and are resolved server-side using the application's IAM role, service account, or API key. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the scope-changing confidentiality impact (CVSS S:C/C:H) warrants prompt patching for any deployment exposing the Vercel AI adapter or similar UI adapters to untrusted clients.

Server-side request forgery in swagger-typescript-api <= 13.12.1 allows an attacker who controls or influences an OpenAPI spec to force the generator process to issue arbitrary HTTP GET requests to any host reachable from the generator's network - including loopback addresses, RFC-1918 ranges, and cloud instance-metadata endpoints at 169.254.169.254 - during code generation. Developers and CI/CD pipelines that process untrusted or third-party remote specs via the --url flag are directly in scope; the companion auth-token forwarding finding (filed separately by the same researcher) can escalate this from blind SSRF to direct credential exfiltration. A public proof-of-concept with step-by-step reproduction instructions was published alongside the advisory; no active exploitation has been confirmed in CISA KEV.

Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.

Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.

Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to inject malicious URIs that trigger unintended browser requests and limited metadata disclosure when a victim renders crafted graph data. The vulnerability requires victim interaction to load the malicious graph, and no authentication is needed. No public exploit is identified at time of analysis; a vendor patch is available.

Server-side request forgery in JFrog Artifactory Ansible repository handling allows authenticated users with repository access to trigger unintended server-side requests, leading to unauthorized access to internal resources and data manipulation. The flaw resides in URL validation and primarily impacts confidentiality and integrity; vendor-provided fixed versions address the issue. No active exploitation or public exploit code is known at this time.

Server-Side Request Forgery (SSRF) in JFrog Artifactory’s support for Terraform remote repositories allows an authenticated user—or an unauthenticated user if anonymous access is enabled on the repository—to make the Artifactory instance issue outbound HTTP requests to arbitrary destinations and return the response content. This can lead to disclosure of sensitive internal resources and is rated 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No active exploitation or public exploit is known at the time of analysis.

Server-Side Request Forgery (SSRF) in JFrog Artifactory allows an authenticated user with read access to Cargo remote repositories to force the server to request unintended URLs and return the response, potentially exposing internal services and sensitive data. No public exploit code or active exploitation has been identified at time of analysis.

Server-side request forgery (SSRF) in JFrog Artifactory allows authenticated attackers to make unauthorized requests to internal services, potentially exposing internal network resources and cached response data. The vulnerability arises from improper URL validation when handling specific URLs. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS score of 6.5 reflects moderate risk with a requirement for authentication.

Server-side request forgery in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 0.19.1 through 1.4.0 lets the cloud-healthcare-fhir-fetch-page tool dispatch an outbound HTTP GET to an attacker-chosen URL using an authenticated HTTP client, which automatically attaches an Authorization: Bearer credential to every request regardless of destination host - so supplying an arbitrary pageURL (directly in the tool payload or implicitly through a data-driven pagination loop) exfiltrates the caller's OAuth token or the broader Application Default Credentials service-account token to an attacker-controlled listener. Exploitation requires an attacker who can reach and influence the tool as an authenticated MCP client (CVSS PR:L) and depends on credential configuration for the more damaging service-account outcome, matching the vendor's high attack-complexity rating; no public exploit code has been identified at time of analysis (SSVC exploitation: none, Automatable: no) and EPSS is low at 0.25% (16th percentile), so this is a genuine-but-moderate credential-disclosure issue rather than an urgent one.

Server-side request forgery (SSRF) in the ip-address JavaScript library allows bypass of security checks on IPv4-mapped and NAT64 IPv6 addresses. Versions 10.1.1 through 10.2.0 misclassify these addresses as global unicast instead of recognizing their embedded IPv4 addresses, enabling potential SSRF attacks against internal networks. No public exploit is identified, but the fix is available in version 10.2.1.

Server-side request forgery in Arista VeloCloud Orchestrator On-Prem lets an authenticated tenant account with at least the Enterprise Standard Admin role induce the Orchestrator to issue requests to internal services that are otherwise unreachable, because a VCO feature fails to sufficiently validate caller-supplied input. Impact is scoped to subsequent systems rather than the Orchestrator itself (low confidentiality/integrity, no availability effect), so real risk depends on what internal services a given deployment can route to. No public exploit code or active exploitation is known - Arista discovered the issue internally and confirms no malicious use in customer networks - although EPSS places it around the 82nd percentile, and vendor patches are available for the affected release trains.

Server-side request forgery (SSRF) in the Feedzy WordPress plugin version 5.2.4 and below allows authenticated contributors to craft malicious RSS feed URLs, leading to unauthorized requests to internal or external resources. This could disclose limited internal service information or allow low-integrity modifications, but exploitation requires high attack complexity and contributor-level access. No active exploitation or public proof-of-concept has been identified at the time of analysis.

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX WordPress plugin versions up to 2.3.5 allows remote attackers to

XML External Entity processing in proCertum SmartSign allows server-side request forgery (SSRF) and local file disclosure via crafted signature files. The vulnerability is triggered when a victim merely previews a malicious file in the file selection window, before clicking Open. patched in version 9.4.3.90. No active exploitation or public exploit code identified.

Server-side request forgery in Kimi Code's FetchURL tool allows attackers who can influence a FetchURL call (e.g., via prompt injection) to bypass hostname and IP denylists by using crafted public hostnames that resolve to internal addresses or via HTTP redirects, exposing internal network services. No public exploit or active exploitation identified at the time of analysis.

Unauthenticated server-side request forgery (SSRF) and arbitrary local file read in Printcart Designer for WooCommerce versions prior to 2.5.3 allows attackers to exfiltrate sensitive configuration files and probe internal network resources. Public exploit code is available, and the patch has been released by the vendor.

Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated remote attackers to manipulate server-side requests, potentially accessing internal resources. Public exploit code is available in the project's GitHub issue tracker, but no active exploitation has been confirmed through CISA KEV. The vulnerability affects deployments where the browser control API is exposed, requiring low-privilege access to exploit.

Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Server-Side Request Forgery in the Complianz WordPress GDPR compliance plugin (versions 7.5.0 and below) allows authenticated attackers with Author-level privileges or higher to forge requests from the server, enabling internal network probing and limited confidentiality and integrity impact. The Scope:Changed CVSS metric confirms the vulnerability crosses the server's trust boundary, a characteristic consistent with SSRF enabling access to internal resources unreachable by the attacker directly. No public exploit code has been identified at time of analysis, and the high privilege requirement (PR:H) substantially limits opportunistic exploitation.

Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.

Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.

Server-Side Request Forgery in the Photo Block WordPress plugin (versions 1.7.1 and earlier) allows authenticated administrators to cause the hosting WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network services. The CVSS scope-change flag (S:C) indicates impact extends beyond WordPress itself to back-end infrastructure reachable from the server. No public exploit code and no CISA KEV listing exist at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool to compromised admin accounts or rogue administrators.

Server-side request forgery in Progress Telerik UI for ASP.NET AJAX's RadEditor PDF export feature enables authenticated attackers to force the web server to issue outbound HTTP requests to arbitrary attacker-controlled hosts. Because the affected product runs on Windows, those outbound connections can carry Windows NTLM authentication material, exposing credentials for potential relay or offline cracking attacks. The vulnerability affects all versions prior to v2026.2.708 and carries a vendor-confirmed CVSS 6.5 (High confidentiality impact) with no public exploit identified at time of analysis.

Server-side request forgery in n8n workflow automation platform (versions before 1.123.64) enables authenticated low-privilege users to redirect the n8n server's HTTP requests to arbitrary internal network targets by injecting absolute URLs into routing configuration on dynamic-node-parameters endpoints that lack authorization scopes. The CVSS 4.0 vector assigns SC:H - high subsequent-system confidentiality impact - reflecting the risk of internal infrastructure exposure including cloud metadata endpoints, internal APIs, and private services. Exploitation is conditional on SSRF protection being disabled; no public exploit identified at time of analysis and no CISA KEV listing.

Server-side request forgery in Gitea's repository migration feature allows authenticated low-privilege users to bypass the SSRF allow/block-list filter by supplying an attacker-controlled DNS hostname that returns both a permitted public IP and a blocked private or loopback IP. Because the pre-flight validation accepts the hostname if any single resolved IP is permitted (OR logic), and because the subsequent `git clone --mirror` subprocess performs an independent DNS resolution with no binding to the validated IP set, an attacker can cause Gitea to connect to internal-only Git services and exfiltrate their contents into an attacker-controlled repository. No public exploit identified at time of analysis, but a functional proof-of-concept reproducer is included in the advisory and has been confirmed by the reporter against a specific Gitea commit.

Server-Side Request Forgery in Gitea's `restore-repo` CLI command allows an attacker who can supply a malicious dump archive to a Gitea administrator to force the server to issue `git fetch` against arbitrary attacker-controlled or internal URLs, including cloud metadata endpoints and local filesystem paths via `file://`. The root cause is a Go language logic defect: `CheckAndEnsureSafePR` is invoked with an empty `commonCloneBaseURL` string, causing `strings.HasPrefix(anything, "")` to always return `true`, which silently disables the URL validation guard for `Head.CloneURL` in the restore path only. A detailed PoC is publicly documented in the GHSA advisory; no CISA KEV listing is present, indicating active exploitation is unconfirmed at time of analysis. Fix is available in Gitea v1.27.0.

Blind server-side request forgery in Gitea's OAuth2 avatar synchronization path allows a low-privileged authenticated user to force the server to issue arbitrary outbound HTTP GET requests to attacker-controlled URLs. Gitea versions prior to 1.27.0, when configured with `[oauth2_client] UPDATE_AVATAR = true`, call Go's unrestricted `http.Get()` on the OIDC `picture` claim without applying the `hostmatcher.NewDialContext` restrictions used elsewhere in the codebase - enabling requests to loopback, RFC1918, and cloud metadata addresses such as `169.254.169.254`. No active exploitation is confirmed in CISA KEV, but a functional proof-of-concept is included in the vendor advisory, and the fix is available in Gitea v1.27.0.

Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.

Blind server-side request forgery in AVideo's encoder download-by-URL flow allows authenticated attackers to probe internal network infrastructure by exploiting an unpinned cURL retry fallback. When the primary DNS-pinned fetch to a supplied downloadURL fails, the application retries with a null resolvedIP argument to ssrfPinnedFetchToFile, stripping the DNS-binding protection and allowing attacker-controlled HTTP redirects to reach RFC-1918 or loopback addresses. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; the CVSS 4.0 score of 5.3 with PR:L reflects a real but bounded risk gated behind authenticated access.

Server-side request forgery in Huginn through 2022.08.18 allows any authenticated user to weaponize the ScenarioImport fetch_url method to issue arbitrary outbound HTTP requests from the server. An attacker with low-privilege access can probe internal network topology, enumerate ports via timing and error signatures, and - critically - reach cloud Instance Metadata Service (IMDS) endpoints such as AWS 169.254.169.254 to harvest IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix (PR #3684) and disclosure by VulnCheck confirm the vulnerability.

Server-side request forgery in HyperDX before 2.31.0 allows authenticated team members to redirect the application server to arbitrary internal network destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, which performed no URL validation, protocol restriction, or private IP blocklist enforcement. The endpoint further reflected raw error response bodies back to the caller, enabling exfiltration of responses from internal APIs, container services, and cloud provider instance metadata endpoints such as AWS IMDSv1. No public exploit code has been identified and the vulnerability is not in CISA KEV, but the CVSS 4.0 vector assigns High confidentiality impact to subsequent systems (SC:H), reflecting serious internal infrastructure exposure potential for cloud-hosted deployments.

Server-side request forgery in HyperDX before 2.31.0 allows authenticated team members to weaponize the server's network identity against internal infrastructure by supplying attacker-controlled URLs to the webhook test endpoint. The root cause is an insufficient hostname blacklist that can be bypassed using IPv6 notation (e.g., http://[fd00::1]/path) or other alternate IP representations, enabling enumeration of internal services, interaction with internal containers, and retrieval of cloud instance metadata including IMDSv1 credential endpoints. No public exploit code has been identified and the vulnerability is not in CISA KEV, though the GitHub issue and fix PR are publicly visible, making the attack surface discoverable.

Server-side request forgery in LimeSurvey through versions 6.17.10 and 7.0.4 exposes internal network infrastructure and cloud instance metadata to authenticated attackers via the REST API survey template endpoint. The vulnerability stems from unsanitized use of the HTTP Host header inside the getTemplateData() function, enabling the application server to be weaponized as a proxy to reach internal services and cloud metadata APIs such as AWS IMDSv1 at 169.254.169.254, potentially yielding IAM role credentials. A public proof-of-concept exploit is available via GitHub, raising the urgency of remediation despite the absence of a CISA KEV listing; no public exploit identified at time of analysis for active in-the-wild campaigns, but POC lowers the bar significantly for opportunistic exploitation.

Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis.

Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.

Blind SSRF in SurrealDB's JWKS fetcher before 3.1.5 allows Owner-role database principals to bypass network capability controls by chaining an allowlisted host redirect to blocked internal addresses. The JWKS client in `core/src/iam/jwks.rs` applies `check_capabilities_url` only to the originally configured URL, not to 3xx redirect targets, while the hardened `HttpClient` used by `http::*` functions already re-validates each hop since 3.1.0. Exploitation requires Owner-level credentials and yields only blind timing-based probing of internal hosts - no response body is returned - with no public exploit identified at time of analysis.

Server-Side Request Forgery via HTTP redirect in SurrealDB before 3.1.0 allows authenticated users to circumvent port-scoped `--deny-net` network restriction rules. When an `http::*` function call targets an allowed hostname that responds with a 3xx redirect to a denied `host:port`, the redirect policy in `core/src/fnc/util/http/mod.rs` constructs the redirect `NetTarget` from `url.host_str()` alone - silently discarding the port - causing the capability matcher to skip port-specific deny rules entirely. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Server-Side Request Forgery in SurrealDB's JWKS fetcher allows an Owner-role attacker to weaponize the server as an internal network proxy. By configuring an access method with a JWKS URL whose hostname passes the string-based allow-list check but resolves via DNS to a private or loopback address, the attacker causes SurrealDB to issue GET requests to internal infrastructure that would otherwise be unreachable. No public exploit has been identified and no CISA KEV listing exists; exploitation is constrained by the requirement for Owner-level privileges, making this a meaningful but bounded risk in privileged-access-compromise scenarios.

Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.

Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.

Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the `isPrivateOrRestrictedIP` function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.

Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.

Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to forge arbitrary HTTP requests via the `receiver_thread` function within the swarm service's `http_request` component (`claw/services/swarm/swarm.c`). The CVSS 4.0 vector confirms fully remote, unauthenticated, low-complexity exploitation with no user interaction required. A public proof-of-concept exists via GitHub issue #140, and the vendor had not responded to the coordinated disclosure at the time of reporting - no patch is available.

Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows unauthenticated remote attackers to manipulate the url argument passed to the claw_net_get and claw_net_post functions in claw/tools/tool_net.c, causing the server to initiate arbitrary outbound HTTP requests. This can be leveraged to probe internal network resources, bypass perimeter controls, or interact with backend services not otherwise exposed. No public exploit identified at time of analysis beyond publicly available exploit code, and the vendor has not responded to the coordinated disclosure made via GitHub issue #139.

Server-side request forgery in rt-claw up to 0.2.0 allows unauthenticated remote attackers to manipulate the `url` argument in the `claw_net_get` and `claw_net_post` HTTP request functions, coercing the server into issuing arbitrary outbound requests to internal or external resources. A proof-of-concept exploit has been publicly disclosed via GitHub issue #134. No vendor patch exists - the project maintainer was notified through responsible disclosure but has not responded, leaving deployments with no official fix path.

Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF blocklist in the web_fetch component by targeting IP addresses in the RFC 2544 benchmarking range (198.18.0.0/15) and the reserved-for-future-use range (240.0.0.0/4), which the `isPrivateIP` function in `internal/tools/web_shared.go` failed to block. A publicly available proof-of-concept exploit exists (GitHub issue #1218, corroborated by E:P in the CVSS 4.0 vector), though no CISA KEV entry confirms active widespread exploitation. The bypass is constrained by a PR:L requirement and by the rarity of infrastructure that routes these non-standard ranges to reachable internal services.

Server-side request forgery in SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 allows authenticated users to circumvent administrator-configured deny-net network restrictions by exploiting unchecked HTTP redirects in the native http::* query functions. An attacker operates a public HTTP server that issues 301 or 307 redirects to denied internal addresses; SurrealDB follows those redirects without re-validating the destination against the deny-net ACL, and returns the internal response directly to the attacker's query result. No public exploit code has been identified at time of analysis; this issue was discovered by cure53 during a commissioned security audit and penetration test of SurrealDB.

Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in `pkg/utils/http_guard.go` fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as `http://[2001:db8::5efe:127.0.0.1]`. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.

Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make the server issue arbitrary HTTP requests by injecting a malicious URL into the download_url, download_urls, or proxy arguments of the plugin update handler. The affected endpoint resides in astrbot/dashboard/routes/plugin.py within the update_plugin and update_all_plugins functions. A public proof-of-concept exploit exists on GitHub, and the vendor did not respond to the coordinated disclosure, leaving users without an official patch.

Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.

Full-read server-side request forgery in CloudTAK (npm @tak-ps/cloudtak) v13.5.0 and earlier allows any authenticated user to coerce the API server into fetching attacker-supplied URLs - including the cloud instance metadata endpoint (169.254.169.254), loopback, RFC1918, and CGNAT ranges - with the full internal HTTP response body reflected verbatim in the API reply. The vulnerability exists in the `PUT /api/basemap` endpoint, where user-controlled URLs pass directly from URL parsing to `fetch()` with no IP-address classification and default redirect-following enabled. Three independent bypass classes (direct IP literals, decimal IP encoding, and 302-redirect chain exploitation) are confirmed end-to-end in the published advisory's proof-of-concept; no vendor-released patch is available at time of analysis, and no CISA KEV listing exists, but publicly available exploit code lowers the skill bar significantly.

Server-side request forgery in Dendrite through 0.13.8 allows unauthenticated remote attackers to weaponize the server as a port-scanning proxy against internal networks by supplying arbitrary host and port values via the unvalidated `serverName` parameter on the legacy media download endpoint. The server initiates outbound TLS connections to attacker-controlled destinations, and distinguishable error response classes combined with leaked internal IP addresses in error messages expose internal network topology. A publicly available proof-of-concept exploit exists; this vulnerability is not currently listed in CISA KEV.

Server-side request forgery in poco-ai/poco-claw up to version 0.5.4 allows remote unauthenticated attackers to coerce the application server into issuing arbitrary HTTP requests to attacker-controlled destinations via the unvalidated callback_url parameter in the run_task API function. The flaw is exposed through the task execution endpoint at executor/app/api/v1/task.py and carries a publicly available proof-of-concept exploit referenced on GitHub. No vendor patch has been released; the associated GitHub issue was closed automatically due to inactivity, indicating no active maintenance response and indefinite risk exposure.

Server-side request forgery in OpenClaw's browser snapshot routes allows lower-privileged authenticated users to bypass the platform's network policy controls and reach internal destinations that should be blocked. Affected versions span 2026.4.14 through 2026.5.25; the fix shipped in 2026.5.26 per the vendor's GitHub security advisory. No public exploit code has been identified and this CVE is not listed in CISA KEV, though the CVSS 4.0 subsequent-system confidentiality rating of High reflects the real potential for lateral access to sensitive internal services.

Authorization bypass in OpenClaw (versions 2026.3.28 through before 2026.5.19) allows low-privileged network attackers to exploit the browser act route's failure to validate current-tab URLs, enabling Server-Side Request Forgery (SSRF) that crosses authorization boundaries into restricted resources. The CVSS 4.0 scope-change metrics (SC:H/SI:L with VC:N/VI:N/VA:N) reveal that the primary impact falls on subsequent systems rather than OpenClaw itself - meaning attackers can reach internal resources or perform policy-restricted actions using their laundered, lower-trust credentials. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.

OpenClaw's QQBot media upload feature fails to enforce network-destination policy for lower-trust callers, enabling server-side requests to reach internal or blocked network addresses. Versions 2026.4.20 up to (but not including) 2026.5.28 are affected; the CVSS 4.0 score of 2.3 reflects that practical impact is tightly bounded by operator configuration - only subsequent-system confidentiality at a Low level is indicated (SC:L), with no direct impact to the vulnerable component itself. No public exploit code or active exploitation has been identified at time of analysis.

Network policy bypass via Server-Side Request Forgery (SSRF) in OpenClaw's sandbox exec-server allows lower-trust callers to route HTTP requests to internal network destinations that OpenClaw policy is explicitly configured to block. All OpenClaw installations before version 2026.6.6 are affected. The CVSS 4.0 vector scores subsequent-system confidentiality impact as High (SC:H), reflecting that successfully bypassed network policies expose internal infrastructure - not the OpenClaw host itself - to unauthorized access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.

Server-side request forgery in BigBlueButton's presentation URL handling allows privileged users to probe internal network resources before version 3.0.23. The presentation URL validation failed to block site-local (RFC 1918) and link-local (169.254.x.x) address ranges, and critically, the redirect-following logic did not pin resolved IP addresses, enabling DNS rebinding attacks that bypass initial validation. No public exploit has been identified at time of analysis, and the EPSS signal is absent from provided data, but the scope-change in the CVSS vector confirms the attack crosses from the BBB application tier into the broader internal network.

Server-side request forgery in HuggingFace text-generation-inference through version 3.3.7 enables unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP GET requests via a crafted image_url value submitted to the OpenAI-compatible multimodal chat completions endpoint. The fetch_image function in router/src/validation.rs applies no destination validation, and the reqwest client's default redirect-following behavior allows attackers to chain redirects to bypass any scheme-level controls, reaching cloud instance-metadata services (e.g., AWS IMDSv1 at 169.254.169.254) to steal IAM credentials or enumerate internal port services. Publicly available exploit code exists (VulnCheck/geo-chen); no KEV listing at time of analysis, but the combination of unauthenticated access, cloud credential theft potential, and working POC makes this a genuine priority for any cloud-hosted TGI deployment.

Server-Side Request Forgery in ToolHive's host-side authentication discovery flow allows a malicious or compromised remote MCP server to force the ToolHive host process to issue arbitrary internal HTTP GET requests with redirect following and no address filtering, bypassing the container isolation that ToolHive is architecturally designed to enforce. Affected versions include all releases through v0.29.3 (commit b672d82f confirmed 2026-06-14); the fix is available in v0.31.0. A publicly reproducible proof-of-concept with recording exists demonstrating retrieval of cloud instance metadata via AWS IMDSv1 redirect; no CISA KEV listing is present, but the exploit is fully operationalized without special infrastructure on any deployment with IMDSv1 enabled.

SSRF protection bypass in the Doyensec safeurl Go library (versions prior to 0.2.4) allows network requests to four newly standardized IPv6 CIDR ranges that were absent from the library's internal blocklist. Applications that explicitly enable IPv6 via EnableIPv6(true) and rely on safeurl to enforce SSRF controls are exposed; attackers who can supply attacker-controlled URLs to such applications may reach internal resources hosted on NAT64 local-use (64:ff9b:1::/48), SRv6 SID (5f00::/16), documentation (3fff::/20), or Dummy IPv6 (100:0:0:1::/64) address space. No public exploit code or CISA KEV listing has been identified at time of analysis.

ToolHive's hand-maintained SSRF guard (`networking.IsPrivateIP`) omits IPv6 NAT64 prefixes `64:ff9b::/96` (RFC 6052) and `64:ff9b:1::/48` (RFC 8215), allowing addresses like `64:ff9b:1::a9fe:a9fe` - the NAT64 encoding of the cloud metadata endpoint `169.254.169.254` - to be misclassified as globally routable and pass unchecked. On ToolHive deployments behind a NAT64/DNS64 gateway (the default in IPv6-only Kubernetes clusters and several IPv6-only cloud environments), an unauthenticated attacker can submit a crafted OAuth `client_id` URL that causes ToolHive's CIMD fetcher to dial internal or link-local addresses the guard is intended to block, achieving a blind internal-reachability oracle. Practical impact is limited to TCP/TLS connection probing rather than credential exfiltration due to HTTPS-only enforcement and TLS verification on the attacker-controlled path; a complete proof-of-concept is publicly available in the vendor advisory, and no public exploit identified at time of analysis as a KEV-listed active campaign.

Server-side request forgery in Wekan's webhook integration feature allows board administrators to register malicious webhook URLs that the Wekan server later fetches without private-network validation, enabling unauthorized access to internal services and cloud metadata endpoints. All Wekan deployments prior to version 9.32 are affected; the root cause is that the existing validateAttachmentUrl() guard present in models/lib/attachmentUrlValidation.js was never wired into the webhook creation and update API paths. No public exploit has been identified and this is not listed in CISA KEV, but cloud-hosted Wekan instances face meaningful credential theft risk via cloud metadata service access.

Server-side request forgery in the strands-agents-tools elasticsearch_memory tool enables prompt-injection attacks that exfiltrate the operator's Elasticsearch API key to attacker-controlled infrastructure. Applications using strands-agents-tools prior to 0.7.0 that rely on the ELASTICSEARCH_API_KEY environment-variable fallback - rather than explicitly passing api_key - are exposed to credential theft when an attacker can influence LLM input. No public exploit code or CISA KEV listing has been identified at time of analysis, but the prompt-injection-to-SSRF primitive is well understood in the AI agent security community and the credential-theft impact warrants prompt remediation.

Full-read SSRF in Koel's podcast subscription feature allows any authenticated user to coerce the server into fetching internal HTTP endpoints - including cloud instance metadata services - and receive the full response. The vulnerability exists because PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE` does not unwrap NAT64 (`64:ff9b::/96`) or 6to4 (`2002::/16`) IPv6 transition addresses, both of which deterministically embed a private IPv4 that the OS kernel routes internally. This affects all Koel deployments through v9.7.0 on NAT64 or dual-stack networks (the default for IPv6-only AWS and GCP subnets); a detailed proof-of-concept with verbatim server output is published in the advisory. No public exploit code is in KEV at time of analysis, but the PoC substantially lowers the exploitation barrier.

Authenticated blind SSRF in Koel v9.6.0 allows any logged-in user to trigger server-side HTTP requests to private, loopback, and RFC1918 destinations by exploiting a missing SafeUrl validation guard on the Subsonic-compatible createPodcastChannel.view route. The main podcast API correctly rejects private URLs with a 422 error, but the Subsonic compatibility layer omits the same SafeUrl rule, and the attacker-supplied URL is fetched synchronously during channel creation via Poddle::fromUrl() - no separate step required. No public exploit identified at time of analysis per KEV status, but a fully documented public PoC with step-by-step curl commands is available in GHSA-w79m-f3jx-779v, validated against the official phanan/koel:9.6.0 Docker image.

Server-side request forgery (SSRF) in Vaultwarden's icon fetching endpoint allows blind internal network and port discovery via crafted hostnames using decimal, hexadecimal, or octal IP representations. Affected versions prior to 1.36.0. Public exploit code exists but no evidence of active exploitation; EPSS score is low (0.23%) suggesting limited real-world risk.

Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated users holding the remote download permission to direct the application server to fetch arbitrary internal URLs via POST /api/v4/workflow/download. Because the downloader accepted user-supplied URLs without validating loopback, localhost, IPv6 localhost, or redirect-to-loopback targets, a low-privileged user could exfiltrate responses from internal services - including cloud instance metadata endpoints, internal APIs, or services bound to 127.0.0.1 - by reading the downloaded content from their own Cloudreve file storage. No public exploit has been identified at time of analysis; vendor-released patch 4.16.1 is available.

SSRF guard bypass in FastGPT prior to 4.15.0-beta5 enables authenticated workflow users to reach cloud metadata endpoints, loopback interfaces, and internal network services that the guard would otherwise block on direct request. The HTTP request workflow node submits the initial URL to the SSRF guard for validation, but then hands the request to axios, which follows HTTP redirects by default without re-triggering the guard - allowing an attacker-controlled redirect server to pivot the request to any internal target. No public exploit code has been identified at time of analysis, but the technique is well-understood, low-complexity once authenticated, and particularly severe in cloud-hosted deployments where IMDSv1 metadata endpoints expose IAM credentials.

Server-side request forgery in mastergo-magic-mcp up to version 0.2.0 allows network-adjacent attackers who influence the `url` argument of the `mcp__getComponentLink` tool to cause the MCP server to issue arbitrary outbound HTTP requests to internal or external destinations. A publicly available proof-of-concept exploit has been published via GitHub issue #89, and the vendor has not yet responded to the coordinated disclosure. The CVSS 4.0 score of 2.1 with E:P reflects a low-impact, user-interaction-dependent scenario that SSVC independently classifies as non-automatable with only partial technical impact.

Server-side request forgery in Simple Machines Forum's image proxy allows any authenticated forum member to force the SMF host to make arbitrary internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. Because SMF automatically generates HMAC signatures authorizing any image URL the proxy encounters, an attacker can obtain a valid signed request targeting cloud instance metadata endpoints (169.254.169.254), RFC1918 internal web applications, and container network services - with no public exploit code identified at time of analysis and no CISA KEV listing. The highest-impact exposure is in cloud-hosted deployments where IMDS credential theft via SSRF could enable lateral movement beyond the SMF host itself.

Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting via the multimodal media fetching subsystem. Versions up to and including v1.3.0 rc16 are affected, allowing a network-accessible attacker to coerce the server into issuing arbitrary outbound HTTP requests to internal or external targets, leading to information disclosure and denial of service. No public exploit code exists and CISA has not listed this in the KEV catalog; EPSS probability sits at 0.11% (2nd percentile), indicating very low observed exploitation pressure at time of analysis.

Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.

SSRF protections in Sonatype Nexus Repository 3 are bypassed when proxy repository upstream servers return HTTP redirects, allowing those redirects to target internal network addresses or cloud metadata endpoints such as AWS IMDSv1. Any user with read access to an affected proxy repository - including anonymous users if anonymous access is enabled - can receive responses from internal infrastructure, potentially leaking cloud IAM credentials or other sensitive internal data. No public exploit or CISA KEV listing has been identified at time of analysis, but the condition relies on attacker-controlled or compromised upstream servers, making this a credible supply-chain-adjacent threat in enterprises relying on external upstream repositories.

Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.