Server-Side Request Forgery

Server-side request forgery in OneUptime's webhook delivery subsystem allows an authenticated project member to bypass the SSRF protection filter by supplying an IPv4-mapped IPv6 address literal such as [::ffff:127.0.0.1], directing the server to connect to loopback services, private network ranges, or cloud metadata endpoints. All OneUptime versions prior to 12.0.7 are affected; the underlying HTTP client treats the mapped form as the embedded IPv4 address, and the webhook response is returned to the attacker. No public exploit has been identified at time of analysis, but the bypass technique is well-documented in SSRF filter evasion literature and requires no special tooling.

Server-Side Request Forgery in mcp-fetch through version 1.6.3 allows unauthenticated attackers who can influence model tool arguments to bypass the SSRF guard entirely and reach loopback, private, and link-local network endpoints including cloud instance metadata services. The bypass exploits a parsing gap: the guard tests the bracketed IPv6 literal string such as [::1] against Node.js's net.isIP(), which returns zero for bracketed input, causing the private-address branch to be skipped; the HTTP client later strips the brackets and connects normally. A secondary flaw in isPrivateIPv6 - no handling of the ::ffff: IPv4-mapped prefix - provides an independent bypass path for IPv4 targets expressed in mapped form. No public exploit code or CISA KEV listing exists at time of analysis, though a public issue report documenting the flaw is open on the upstream repository.

Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.

Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.

Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.

Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.

Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.

Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. No public exploit has been identified at time of analysis, and no confirmed KEV listing exists; however, the scope-changing CVSS vector (S:C) reflects that impact crosses trust boundaries from the application into adjacent internal infrastructure.

Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.

Server-side request forgery in Ech0 through 4.2.1 (Go-based self-hosted application by lin-snow) allows an authenticated admin to exfiltrate data from internal network services and cloud metadata endpoints by exploiting a DNS resolution bypass in webhook URL validation. The validateWebhookURL function checks only literal IP strings via net.ParseIP(), so hostnames like 169.254.169.254.nip.io pass validation unchallenged and DNS-resolve to private IPs at request time. Publicly available exploit code exists (curl-based PoC in GHSA-r2x7-427f-rq69); no confirmed active exploitation (not in CISA KEV). The CVSS 4.0 score of 5.1 reflects the PR:H prerequisite, which substantially limits real-world exposure.

Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application server to reach internal infrastructure, including cloud provider metadata APIs and Kubernetes service endpoints. The root cause is a missing URL-validation call: `fetchPeerConnectInfo` in `internal/service/connect/connect.go` invokes the unguarded `SendRequest` helper rather than the `SendSafeRequest` variant that enforces `ValidatePublicHTTPURL` private-IP blocking. A working proof-of-concept demonstrating AWS IMDSv1 and Kubernetes API enumeration is publicly available in the GHSA advisory; no active exploitation via CISA KEV has been confirmed, though the CVSS 4.0 score of 8.3 with SC:H reflects elevated impact potential for cloud-hosted deployments.

Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rights coerce the HiveServer2/Metastore process into fetching an attacker-chosen URL by planting a crafted avro.schema.url table property on an Avro table that is later queried. The fetch runs with the Hive service identity, exposing cloud instance metadata (e.g. 169.254.169.254), internal-only network services, and local files. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the CVSS 9.1 rating and low attack complexity make it a meaningful post-authentication risk; upgrade to 4.2.1 resolves it.

Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.

Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.

Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.

DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.

Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.

SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.

PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.

Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.

Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.

Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.

Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.

SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.

Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.

Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.

Server-side request forgery in Microsoft's Azure SQL Database cloud service lets an unauthorized network attacker coerce the service into making backend requests that result in privilege elevation, with a maximum CVSS base score of 10.0 driven by a scope change (S:C). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, and the CWE-918 classification confirms the root cause is unvalidated server-issued requests. No public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.

Server-side request forgery in OpenViking before 0.3.4 allows authenticated low-privilege users to pivot the application server into an internal network proxy, reaching loopback addresses, RFC 1918 private ranges, link-local addresses, and cloud metadata endpoints such as AWS IMDS. By POSTing crafted URLs to /api/v1/resources, the attacker causes the server to issue outbound HEAD and GET requests with redirect-following enabled, then retrieves the responses through the normal content APIs - effectively mapping and interacting with internal services invisible from the public network. No public exploit identified at time of analysis; vendor-released patch in v0.3.4 is confirmed.

Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.

Server-side request forgery in Headroom LLM proxy (versions before 0.36.1) allows unauthenticated remote attackers to redirect proxy upstream requests to arbitrary internal, loopback, link-local, or RFC 1918 destinations - including cloud instance metadata endpoints such as 169.254.169.254 - by supplying a crafted x-headroom-base-url request header. The proxy returns upstream responses verbatim to the caller, disclosing internal service content; critically, it also forwards the original Authorization header to the attacker-designated host, enabling credential harvesting. Exploitation is trivially achievable against deployments using the vendor-shipped docker-compose.yml, which binds 0.0.0.0 and enforces no HEADROOM_PROXY_TOKEN by default - a configuration weakness the server itself warns about at startup. No public exploit or KEV listing is identified at time of analysis; a vendor patch is available in v0.36.1.

Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticated tenant holding only the default User role to run arbitrary shell commands as root on the KVM hypervisor host, which also runs other tenants' VMs. The flaw stems from CloudStack fetching a user-supplied .metalink file during directDownload template registration and dispatching its inner URLs to the KVM agent without re-validating them against the scheme allowlist; a related SSRF variant lets the Secondary Storage VM retrieve internal targets and persist them as downloadable templates. No public exploit identified at time of analysis, and no CVSS is provided by the vendor.

Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issuing arbitrary HTTP requests via webhook delivery, reaching internal-only services and cloud metadata endpoints that are otherwise unreachable from outside. It affects Apache CloudStack 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, carries a CVSS 9.1 (high confidentiality and integrity impact), and has no public exploit identified at time of analysis. EPSS is low at 0.14% (4th percentile) and it is not on CISA KEV, indicating no observed active exploitation yet.

Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.

Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM allows unauthenticated remote attackers to induce the server to issue arbitrary internal network requests by submitting maliciously crafted serialized data for deserialization. The underlying root cause is CWE-502 (Deserialization of Untrusted Data), where the deserialization process itself is the vector that triggers the SSRF condition, enabling lateral movement toward backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of network accessibility and no authentication requirement elevates practical risk for internet-exposed deployments.

SSRF in langchain-community's SitemapLoader defeats the documented `restrict_to_same_domain` security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. No public exploit code has been confirmed and the flaw is not listed in CISA KEV at time of analysis, though the attack path is directly derivable from the vulnerability description.

Server-Side Request Forgery in Lightdash's scheduled delivery webhook feature allows authenticated users to direct the backend server to issue POST requests to private, loopback, and link-local addresses - including cloud instance metadata endpoints. All deployments running versions prior to 1.146.4 are affected; both the Google Chat and Microsoft Teams webhook delivery paths bypass the existing validatePublicHttpUrl sanitization that is correctly applied elsewhere in the codebase. While the upstream response is never relayed to the attacker, the error-vs-success distinction enables internal network probing and, in cloud-hosted deployments, potential access to instance metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-side request forgery in Microsoft Copilot in Azure enables any authenticated Azure user to coerce the service into issuing arbitrary outbound requests, disclosing internal or cloud-infrastructure data back through the Copilot response channel. The CVSS scope-change indicator (S:C) and high confidentiality impact (C:H) suggest the service's privileged network position can be leveraged to reach resources beyond the application boundary - such as Azure Instance Metadata Service endpoints, internal APIs, or adjacent cloud services. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released a server-side patch.

Server-side request forgery in Microsoft Azure Virtual Machines enables a low-privileged authenticated attacker to forge internal network requests, ultimately achieving privilege escalation with full confidentiality, integrity, and availability impact across a changed scope. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) confirms the vulnerability reaches beyond the Azure VM component itself, potentially compromising adjacent Azure services or internal metadata infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released a patch via MSRC.

Server-side request forgery in Microsoft Azure Data Factory exposes sensitive internal information to unauthenticated remote attackers over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network positioning - any internet-reachable instance is in scope. No active exploitation has been confirmed by CISA KEV or public POC at time of analysis; SSVC rates exploitation as 'none' and EPSS at 0.99%, indicating limited real-world uptake despite the high CVSS base score.

Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.

Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged attacker to abuse a server-side request forgery flaw (CWE-918) to reach protected internal endpoints and escalate privileges across a security scope over the network. The flaw carries a critical CVSS 9.9 with a scope change, meaning a foothold in one context can be leveraged to compromise resources beyond the attacker's original authorization. Microsoft has issued a service-side fix; there is no public exploit identified at time of analysis and no CISA KEV listing.

Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request forgery (CWE-918) flaw to make the service issue attacker-controlled internal requests, crossing a privilege/trust boundary (CVSS scope change) to reach backend resources. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; Microsoft, the reporter, has already remediated the cloud service per its MSRC advisory.

Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR.

Server-side request forgery in @platejs/docx-io prior to 53.3.2 allows network-accessible attackers to exfiltrate internal network content by supplying crafted HTML to the htmlToDocxBlob function. When attacker-controlled HTML containing img tags referencing internal URLs is processed server-side, the converter fetches those resources and embeds the response bytes into the generated DOCX, creating a response-disclosure channel to internal network infrastructure. No public exploit code has been identified at time of analysis, but the attack technique is well-understood and requires no specialized tooling beyond crafted HTML.

DNS rebinding in link-preview-js prior to 4.0.4 allows unauthenticated remote attackers to bypass the library's built-in SSRF protections and reach internal HTTP resources from the server hosting the preview service. The resolveDNSHost callback resolves a hostname once for validation but passes the original hostname back to the fetch layer, creating a time-of-check/time-of-use window that an attacker-controlled DNS server can exploit by returning a legitimate public IP during validation and an internal or loopback address on subsequent resolution. Vendor-released patch 4.0.4 is available; no public exploit identified at time of analysis, though the full fix is publicly documented in GitHub PR #181 and the GHSA-cpjf-6666-r8fx advisory.

Server-Side Request Forgery in Apache InLong Manager (versions 2.0.0-2.3.x) allows any authenticated user - no administrative role required - to coerce the Manager service into issuing outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This effectively turns the InLong Manager into an open proxy for internal network reconnaissance, enabling access to otherwise firewalled services such as cloud instance metadata endpoints, internal APIs, or database management interfaces. No public exploit has been identified at time of analysis, but the low privilege bar makes this broadly reachable within any deployment that permits shared user access.

Server-side request forgery in ATutor's import functionalities allows an authenticated administrator to coerce the server into issuing HTTP requests to arbitrary internal endpoints, cloud metadata services such as AWS IMDSv1, or local filesystem paths via the file:// URI scheme where PHP URL wrappers are enabled. Only version 2.2.4 has been confirmed vulnerable by CERT.pl researchers; the product is end-of-life with no planned fix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of cloud metadata reachability and EOL status makes compensating controls the only available path.

SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.

Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.

SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.

Blind Server-Side Request Forgery in Omnivore's webhook registration flow allows any authenticated user to coerce the application server into issuing repeated HTTP requests to arbitrary internal endpoints, including cloud instance metadata services. The flaw affects all Omnivore API server deployments (CPE: cpe:2.3:a:omnivore-app:omnivore:*:*:*:*:*:*:*:*) and is rooted in setWebhookResolver accepting and persisting caller-supplied URLs with no address validation before callWebhook later executes them via axios. No public exploit identified at time of analysis, and no CISA KEV listing exists; a patch commit is available upstream.

Server-side request forgery in Omnivore's scanFeedsResolver GraphQL endpoint allows authenticated users to direct the API server to fetch arbitrary internal URLs, bypassing the validateUrl() guard consistently applied elsewhere in the same codebase. Reachable internal endpoints return partial feed metadata (URL, title, description, type) and advertised RSS/Atom link elements; unreachable ports are distinguishable through error differentiation, enabling internal network enumeration. No public exploit has been identified and this vulnerability is not listed in CISA KEV; an upstream patch has been merged as commit c4d7d8562.

Server-Side Request Forgery in PullMD 3.2.0 exposes internal network resources and cloud metadata endpoints through the unauthenticated REST API endpoint GET /api, where the url parameter is passed without validation to the server's HTTP fetch stack. The vulnerability affects multiple fetch paths including the MCP read_url tool, Reddit resolver, and Playwright sidecar, all of which lacked SSRF guards prior to v3.3.0. A public exploit exists (GitHub issue #41), and the changelog confirms that 169.254.169.254 and 100.100.100.200 (AWS/Alibaba cloud metadata) were specifically demonstrated as targets; no active exploitation has been confirmed by CISA KEV.

Unauthenticated access to the Kafka Connect REST API in Splunk Connect for Kafka versions below 2.2.7 enables an SSRF-class attack that reconfigures the HTTP Event Collector destination to an attacker-controlled endpoint, resulting in theft of HEC authentication credentials and partial manipulation of event delivery to Splunk Enterprise. The connector's HEC endpoint validation does not enforce secure transport by default, meaning a non-TLS HTTP destination can be substituted without any authentication. No public exploit has been identified at time of analysis, but the attack requires no privileges and trivially low complexity, making any deployment with a network-exposed Kafka Connect REST API immediately actionable.

Server-Side Request Forgery (SSRF) in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows an authenticated Splunk user holding the get_talos_enrichment capability to redirect the instance's outbound authenticated management requests to an attacker-controlled server, exposing Splunk management tokens. Successful exploitation grants the attacker full control over the Splunk instance, compromising the confidentiality, integrity, and availability of all data and configurations within it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available and the CVSS score of 8.8 reflects the severity of token theft as a post-exploitation path.

Splunk SOAR versions below 8.6.0 contain a Server-Side Request Forgery flaw in the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) that allows an authenticated Administrator-role user to direct the SOAR platform to initiate outbound network connections to arbitrary destinations. This enables internal network enumeration - discovering reachable hosts and open ports using the SOAR instance's network position, which is typically privileged within enterprise SOC environments. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS score of 2.7 (Low) accurately reflects the high privilege prerequisite, though the risk is elevated in environments where the SOAR platform has broad internal network access.

Splunk Secure Gateway's failure to validate decoded report notification identifiers enables any authenticated low-privileged user to hijack system-level REST API sessions in Splunk Enterprise, achieving full configuration control and credential theft without requiring admin or power role. Affected versions span multiple Splunk Enterprise branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) and Splunk Secure Gateway branches (3.8.x, 3.9.x, 3.10.x). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack path and high-impact outcome (C:H/I:H/A:H) make this a realistic internal threat in any multi-tenant or shared Splunk deployment.

Server-Side Request Forgery in Splunk Enterprise and Splunk Secure Gateway allows low-privileged authenticated users to manipulate internal Splunk services via crafted report notification paths. Affected versions span Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.9, 3.9.23, and 3.8.70. An attacker holding any valid Splunk account - excluding admin and power roles - can leverage the unvalidated path handling in Secure Gateway to issue system-authenticated internal requests, potentially disrupting Search Head Cluster state or causing denial of service. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure.

Hardened-mode SSRF protections in the mcp-searxng Node.js MCP server (npm/mcp-searxng < 1.2.1) can be bypassed via three distinct techniques, allowing `web_url_read` to fetch loopback and internal network resources despite `MCP_HTTP_HARDEN=true` being set. The bypasses exploit: unvalidated HTTP redirect chains to internal addresses, the unblocked `0.0.0.0` special address, and IPv4-mapped IPv6 literals that survive Node's WHATWG URL canonicalization intact but defeat regex-based private-address filters. Publicly available proof-of-concept code demonstrates all three bypass paths returning content from a loopback sentinel service; no KEV listing exists at time of analysis.

Server-Side Request Forgery in mcp-searxng's web_url_read tool allows any caller - including an LLM steered via prompt injection - to make the server fetch internal HTTP services and cloud metadata endpoints (e.g., http://169.254.169.254/) and return their contents into the model context. The SSRF guard function assertUrlAllowed exists in the codebase but ships disabled because MCP_HTTP_HARDEN defaults to false, meaning all default deployments of versions prior to 1.2.1 are unprotected. Publicly available exploit code exists, validated on v1.1.0; no CISA KEV listing was present at time of analysis.

Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF protections by supplying DNS-resolvable hostnames - such as 169-254-169-254.nip.io resolving to the cloud metadata address 169.254.169.254 - that pass the synchronous string-based blocklist check but reach blocked internal IP ranges at request delivery time. Although the pre-existing delivery-time fetchSafe guard independently blocked the reported proof-of-concept IPv4 cloud metadata target since v8.35/v8.36, the inconsistent dual-validation architecture left IPv6 address family resolution unchecked and maintained a separate, drift-prone blocklist in ssrfGuard.js that could diverge from the input-time validator across software revisions. No public exploit identified at time of analysis; vendor-released patch is confirmed as version 9.74.

Server-Side Request Forgery in @contentful/mcp-tools allows any party who can invoke MCP tools or inject instructions into Contentful content to redirect the server's Contentful Management API Personal Access Token (PAT) to an attacker-controlled endpoint. The export_space and import_space tools spread LLM-controlled arguments - including host, proxy, rawProxy, and insecure - directly into the options object alongside the server-side PAT, causing the Contentful Management SDK to build its baseURL from attacker input and attach Authorization: Bearer <PAT> to all outgoing requests. A confirmed working proof-of-concept exists demonstrating both host-redirect and proxy-redirect vectors; no CISA KEV listing was identified at time of analysis, but the prompt injection path requires zero MCP privileges and represents a high-severity real-world risk for any AI agent reading untrusted Contentful content.

Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).

DNS rebinding in keeper.sh's calendar module (versions prior to 2.18.14) allows authenticated attackers to bypass the SSRF guard and route outbound HTTP connections to private network addresses, including cloud instance metadata endpoints such as 169.254.169.254. The flaw arises from a two-phase design: the guard resolves a hostname's IP addresses, asserts they are public, then discards those resolved addresses before independently re-resolving the hostname at socket-open time - an attacker controlling authoritative DNS can serve a public IP during validation and swap it to a private IP for the subsequent connection. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.18.14.

Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.

Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the api.webhooks.write permission register webhook URLs that the server dereferences with no protocol allow-listing. Because WebhookController.php validates the URL only with FILTER_VALIDATE_URL and WebhookDispatcher.php builds cURL without CURLOPT_PROTOCOLS/CURLOPT_REDIR_PROTOCOLS, an attacker can force the server to fetch file://, gopher://, dict://, and private/link-local targets, exfiltrating local files and internal HTTP responses including cloud metadata credentials. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause and fix are confirmed in the vendor advisory and commit.

XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.

Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attackers to forge outbound HTTP requests from the server, exposing internal network resources and sensitive information. The CVSS scope-change indicator (S:C) confirms that forged requests can reach internal systems beyond the vulnerable host itself - a meaningful escalation for an enterprise IT management platform with privileged access to server infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis; Dell has released version 4.7.0 as the remediated build per advisory DSA-2026-359.

Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application server's HTTP client toward loopback and RFC 1918 private-network destinations by supplying arbitrary values in the webhook subscription delivery_address parameter. When a matching fact-change event fires, Stigmem's backend issues an unsolicited HTTP POST to the attacker-specified internal address, enabling interaction with co-located internal services the attacker could not otherwise reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation probability is currently unquantified.

Server-side request forgery in ArcadeDB before 26.8.1 allows authenticated low-privilege users to weaponize the OpenCypher LOAD CSV feature to issue arbitrary HTTP/HTTPS requests from the database server host, reaching internal network services and cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the content of these restricted destinations, enabling exfiltration of internal service data or cloud IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.3 with SC:H reflects meaningful lateral impact against adjacent cloud and internal infrastructure.

Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot through the AIL server and reach internal networks, cloud metadata services (including 169.254.169.254), loopback addresses, and RFC1918 ranges. All versions covered by CPE cpe:2.3:a:ail-project:ail-framework:*:*:*:*:*:*:*:* are affected because manual crawler tasks bypass the existing domain blacklist via a priority-routing logic flaw, and crawled responses - including HTML, screenshots, and HAR data - are returned directly to the attacker, making exfiltration of cloud IAM credentials or internal service data straightforward. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor-released patch is available via upstream GitHub commit d7b60ff.

Server-Side Request Forgery in Animation Addons for Elementor WordPress plugin (versions before 2.7.2) permits unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal network hosts and relay the responses back to the attacker. The vulnerability stems from unsanitized user-supplied input being used directly to construct the host component of a server-side HTTP request. No public exploit or CISA KEV listing has been identified, and EPSS places exploitation probability at 0.15% (4th percentile), though SSVC notes the attack is automatable.

Server-side request forgery in Netflix Lemur's authority update path allows an authenticated user holding an authority role to redirect the Lemur backend into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. This is an incomplete-fix bypass of CVE-2026-55166 (GHSA-v2wp-frmc-5q3v): the creation-time allowlist check in `_validate_acme_url` was never applied to the `PUT /api/1/authorities/` update path, leaving the stored `acme_url` writable without re-validation. The fix is shipped in v1.9.3 with no public exploit identified at time of analysis.

Server-side request forgery in Netflix Lemur prior to 1.9.3 allows authority-role users to redirect ACME certificate issuance workflows to attacker-controlled servers, enabling JWS-signed HTTP requests to reach internal services or cloud metadata endpoints. The flaw exists in two components acting together: the PUT /api/1/authorities/ endpoint accepted acme_url modifications without revalidating the host against an allowlist, and the ACME ClientV2 blindly followed server-supplied URLs for nonce, order, authorization, and finalize operations without confirming the hostname matched the configured directory. No public exploit identified at time of analysis; vendor-released patch available in version 1.9.3.

Server-Side Request Forgery in FUXA 1.3.2 and earlier allows authenticated non-admin runtime users to weaponize the FUXA server as an outbound HTTP proxy, reading responses from internal services and cloud metadata endpoints. The vulnerability exists in the device-webapi-request Socket.IO handler, which applies no ownership or allowlist validation to the user-controlled property.address parameter before issuing the request. Patch is available as of version 1.3.3; no public exploit code or CISA KEV listing identified at time of analysis.

SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.

Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported.

Server-side request forgery in MagicMirror² versions prior to 2.37.0 allows unauthenticated remote attackers to make the mirror server issue arbitrary outbound HTTP requests to attacker-controlled URLs, including to internal network services. The vulnerability stems from the ADD_CALENDAR handler on the unauthenticated Socket.IO /calendar namespace accepting a fully attacker-controlled URL, authentication headers, and a TLS-bypass flag with no SSRF validation. When the internal target returns valid iCal data, the parsed event content is returned to the attacker via CALENDAR_EVENTS, enabling blind-to-semi-open SSRF with data exfiltration. A working proof-of-concept (exploit-ssrf-calendar.js) is documented in the GHSA advisory; no CISA KEV listing at time of analysis.

Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2: an attacker holding admin role on a webhook-enabled job template can forge a signed GitHub pull request webhook with an arbitrary statuses_url, causing AWX to POST authenticated status updates - including the configured Git Personal Access Token in the Authorization header - to an attacker-controlled or internal endpoint. The Changed scope (S:C) in the CVSS 7.7 vector reflects that the leaked PAT extends attacker reach beyond AWX to connected Git repositories and any internal services reachable via SSRF. No public exploit identified at time of analysis, and no CISA KEV listing exists.

Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.

Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.

Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through the agent's fetch_url tool by exploiting a time-of-check-time-of-use gap in its DNS-pinning defense. Because the pre-fetch validator treated a failed DNS lookup as a pass-through ('let the HTTP request proceed and fail naturally'), an attacker who controls DNS responses can make the safety check see a non-resolving or benign answer while the real request resolves to an internal address, bypassing the SSRF allow/deny policy. No public exploit identified at time of analysis; a vendor patch and fix commit exist, and the issue was reported by VulnCheck.