Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3205 vulnerabilities reference this CWE, most recent first.
CVE-2026-125367 (GCVE-0-2026-125367)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Pico through 4.1.2 SSRF in Feeds Service via run SSH Command
Summary
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.
Severity
5.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/picosh/pico/issues/229 | issue-tracking |
| https://github.com/picosh/pico | product |
| https://github.com/picosh/pico/blob/v4.1.2/pkg/ap… | technical-description |
| https://github.com/picosh/pico/commit/48a85d6 | patch |
| https://www.vulncheck.com/advisories/pico-through… | third-party-advisory |
Date Public
2026-11-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/picosh/pico",
"product": "pico",
"vendor": "picosh",
"versions": [
{
"lessThanOrEqual": "4.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:39.868Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #229",
"tags": [
"issue-tracking"
],
"url": "https://github.com/picosh/pico/issues/229"
},
{
"tags": [
"product"
],
"url": "https://github.com/picosh/pico"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358"
},
{
"tags": [
"patch"
],
"url": "https://github.com/picosh/pico/commit/48a85d6"
},
{
"name": "VulnCheck Advisory: Pico through 4.1.2 SSRF in Feeds Service via run SSH Command",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command"
}
],
"title": "Pico through 4.1.2 SSRF in Feeds Service via run SSH Command",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125367",
"datePublished": "2026-11-09T23:27:39.868Z",
"dateReserved": "2026-11-09T22:03:02.822Z",
"dateUpdated": "2026-11-09T23:27:39.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125366 (GCVE-0-2026-125366)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Omnom through 0.9.0 SSRF via Add Feed /add_feed Route
Summary
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.
Severity
5.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/asciimoo/omnom/issues/67 | issue-tracking |
| https://github.com/asciimoo/omnom | product |
| https://github.com/asciimoo/omnom/blob/v0.9.0/fee… | technical-description |
| https://github.com/asciimoo/omnom/commit/01c45510… | patch |
| https://www.vulncheck.com/advisories/omnom-throug… | third-party-advisory |
Date Public
2026-11-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/asciimoo/omnom",
"product": "omnom",
"vendor": "asciimoo",
"versions": [
{
"lessThanOrEqual": "0.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:39.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #67",
"tags": [
"issue-tracking"
],
"url": "https://github.com/asciimoo/omnom/issues/67"
},
{
"tags": [
"product"
],
"url": "https://github.com/asciimoo/omnom"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421"
},
{
"tags": [
"patch"
],
"url": "https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10"
},
{
"name": "VulnCheck Advisory: Omnom through 0.9.0 SSRF via Add Feed /add_feed Route",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route"
}
],
"title": "Omnom through 0.9.0 SSRF via Add Feed /add_feed Route",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125366",
"datePublished": "2026-11-09T23:27:39.142Z",
"dateReserved": "2026-11-09T22:03:02.429Z",
"dateUpdated": "2026-11-09T23:27:39.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125363 (GCVE-0-2026-125363)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
MikroDash before 0.8.79 SSRF via Personal Notification Channels
Summary
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.
Severity
5.4 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/SecOps-7/MikroDash/security/ad… | vendor-advisory |
| https://github.com/SecOps-7/MikroDash/commit/4a40… | patch |
| https://github.com/SecOps-7/MikroDash/releases/ta… | release-notes |
| https://github.com/SecOps-7/MikroDash/blob/v0.8.7… | technical-description |
| https://www.vulncheck.com/advisories/mikrodash-be… | third-party-advisory |
Impacted products
Date Public
2026-11-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MikroDash",
"repo": "https://github.com/SecOps-7/MikroDash",
"vendor": "SecOps-7",
"versions": [
{
"lessThan": "0.8.79",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:36.416Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xf3p-2j7c-6hg4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/SecOps-7/MikroDash/security/advisories/GHSA-xf3p-2j7c-6hg4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SecOps-7/MikroDash/commit/4a40d104faa9f6d7b7539a3ce78fb91509d40cce"
},
{
"name": "MikroDash v0.8.79 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/SecOps-7/MikroDash/releases/tag/v0.8.79"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SecOps-7/MikroDash/blob/v0.8.78/internal/server/notify_channels_api.go#L457"
},
{
"name": "VulnCheck Advisory: MikroDash before 0.8.79 SSRF via Personal Notification Channels",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mikrodash-before-0.8.79-ssrf-via-personal-notification-channels"
}
],
"title": "MikroDash before 0.8.79 SSRF via Personal Notification Channels",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125363",
"datePublished": "2026-11-09T23:27:36.416Z",
"dateReserved": "2026-11-09T22:03:01.310Z",
"dateUpdated": "2026-11-09T23:27:36.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125359 (GCVE-0-2026-125359)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
EPSS
VEX
Title
Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting
Summary
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery.
Severity
4.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/fancydirty/mediary-scout/issues/366 | issue-tracking |
| https://github.com/fancydirty/mediary-scout | product |
| https://github.com/fancydirty/mediary-scout/blob/… | technical-description |
| https://github.com/fancydirty/mediary-scout/commi… | patch |
| https://github.com/fancydirty/mediary-scout/relea… | release-notes |
| https://www.vulncheck.com/advisories/mediary-scou… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fancydirty | mediary-scout |
Affected:
0 , < 2026.11.05
(custom)
|
Date Public
2026-11-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "mediary-scout",
"vendor": "fancydirty",
"versions": [
{
"lessThan": "2026.11.05",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:33.452Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #366",
"tags": [
"issue-tracking"
],
"url": "https://github.com/fancydirty/mediary-scout/issues/366"
},
{
"tags": [
"product"
],
"url": "https://github.com/fancydirty/mediary-scout"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/fancydirty/mediary-scout/blob/v2026.10.29/apps/web/lib/pansou-probe.ts#L18-L34"
},
{
"tags": [
"patch"
],
"url": "https://github.com/fancydirty/mediary-scout/commit/9cb9ab5eea492bc8f61f5c4d63f9c6b6800f7e1f"
},
{
"name": "mediary-scout v2026.11.05 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/fancydirty/mediary-scout/releases/tag/v2026.11.05"
},
{
"name": "VulnCheck Advisory: Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mediary-scout-before-2026.11.05-ssrf-via-pansou-search-source-setting"
}
],
"title": "Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125359",
"datePublished": "2026-11-09T23:27:33.452Z",
"dateReserved": "2026-11-09T22:02:59.877Z",
"dateUpdated": "2026-11-09T23:27:33.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125115 (GCVE-0-2026-125115)
Vulnerability from cvelistv5 – Published: 2026-11-09 22:16 – Updated: 2026-11-09 22:16
VLAI
EPSS
VEX
Title
Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Summary
Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.
Severity
6.8 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/novuhq/novu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/novuhq/novu/pull/11197 | x_refsource_MISC |
| https://github.com/novuhq/novu/releases/tag/v3.17.0 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| novuhq | novu |
Affected:
< 3.17.0
|
|
| @novu | application-generic |
Affected:
< 3.17.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "novu",
"vendor": "novuhq",
"versions": [
{
"status": "affected",
"version": "\u003c 3.17.0"
}
]
},
{
"product": "application-generic",
"vendor": "@novu",
"versions": [
{
"status": "affected",
"version": "\u003c 3.17.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:16:35.104Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/novuhq/novu/security/advisories/GHSA-vg6v-j97m-h5xq"
},
{
"name": "https://github.com/novuhq/novu/pull/11197",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/novuhq/novu/pull/11197"
},
{
"name": "https://github.com/novuhq/novu/releases/tag/v3.17.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/novuhq/novu/releases/tag/v3.17.0"
}
],
"source": {
"advisory": "GHSA-vg6v-j97m-h5xq",
"discovery": "UNKNOWN"
},
"title": "Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations \u2014 affects Workflow HTTP request step + Webhook filter condition"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125115",
"datePublished": "2026-11-09T22:16:35.104Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-09T22:16:35.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125114 (GCVE-0-2026-125114)
Vulnerability from cvelistv5 – Published: 2026-11-09 22:14 – Updated: 2026-11-09 22:14
VLAI
EPSS
VEX
Title
Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Summary
Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0.
Severity
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/novuhq/novu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/novuhq/novu/pull/10457 | x_refsource_MISC |
| https://github.com/novuhq/novu/commit/87d965eb883… | x_refsource_MISC |
| https://github.com/novuhq/novu/releases/tag/v3.15.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "novu",
"vendor": "novuhq",
"versions": [
{
"status": "affected",
"version": "\u003c 3.15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:14:57.669Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f"
},
{
"name": "https://github.com/novuhq/novu/pull/10457",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/novuhq/novu/pull/10457"
},
{
"name": "https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68"
},
{
"name": "https://github.com/novuhq/novu/releases/tag/v3.15.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/novuhq/novu/releases/tag/v3.15.0"
}
],
"source": {
"advisory": "GHSA-4x48-cgf9-q33f",
"discovery": "UNKNOWN"
},
"title": "Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-125114",
"datePublished": "2026-11-09T22:14:57.669Z",
"dateReserved": "2026-11-09T17:45:35.936Z",
"dateUpdated": "2026-11-09T22:14:57.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124558 (GCVE-0-2026-124558)
Vulnerability from cvelistv5 – Published: 2026-11-09 02:45 – Updated: 2026-11-09 02:45
VLAI
EPSS
VEX
Title
DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
Summary
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432891 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432891/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124558 | third-party-advisory |
| https://vuldb.com/submit/1035494 | third-party-advisory |
| https://github.com/DataLinkDC/dinky/security/advi… | broken-link |
| https://github.com/DataLinkDC/dinky/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DataLinkDC | Dinky |
Affected:
1.2.0
Affected: 1.2.1 Affected: 1.2.2 Affected: 1.2.3 Affected: 1.2.4 Affected: 1.2.5 cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:datalinkdc:dinky:*:*:*:*:*:*:*:*"
],
"modules": [
"sql-gateway Endpoint"
],
"product": "Dinky",
"vendor": "DataLinkDC",
"versions": [
{
"status": "affected",
"version": "1.2.0"
},
{
"status": "affected",
"version": "1.2.1"
},
{
"status": "affected",
"version": "1.2.2"
},
{
"status": "affected",
"version": "1.2.3"
},
{
"status": "affected",
"version": "1.2.4"
},
{
"status": "affected",
"version": "1.2.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The researcher claims to have submitted a GHSA on the repository of the project."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T02:45:23.269Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432891 | DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432891"
},
{
"name": "VDB-432891 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432891/cti"
},
{
"name": "CVE-2026-124558 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124558"
},
{
"name": "Submit #1035494 | DataLinkDC dinky (dinky-admin) up to and including released tag v1.2.5 (reviewed at commit ce7678eaa13722541f7d1eeda7ffbf8c9f753e20; v1.2.5 was the newest release at the time of review) Server-Side Request Forgery with interaction/read-back",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035494"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/DataLinkDC/dinky/security/advisories/GHSA-x4hx-f425-mrx6"
},
{
"tags": [
"product"
],
"url": "https://github.com/DataLinkDC/dinky/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T15:40:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124558",
"datePublished": "2026-11-09T02:45:23.269Z",
"dateReserved": "2026-11-08T14:17:42.095Z",
"dateUpdated": "2026-11-09T02:45:23.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124507 (GCVE-0-2026-124507)
Vulnerability from cvelistv5 – Published: 2026-11-09 01:00 – Updated: 2026-11-09 01:00
VLAI
EPSS
VEX
Title
conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery
Summary
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432811 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432811/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124507 | third-party-advisory |
| https://vuldb.com/submit/1035482 | third-party-advisory |
| https://github.com/conductor-oss/conductor/securi… | broken-link |
| https://github.com/conductor-oss/conductor/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| conductor-oss | conductor |
Affected:
3.0
Affected: 3.1 Affected: 3.2 Affected: 3.3 Affected: 3.4 Affected: 3.5 Affected: 3.6 Affected: 3.7 Affected: 3.8 Affected: 3.9 Affected: 3.10 Affected: 3.11 Affected: 3.12 Affected: 3.13 Affected: 3.14 Affected: 3.15 Affected: 3.16 Affected: 3.17 Affected: 3.18 Affected: 3.19 Affected: 3.20 Affected: 3.21 Affected: 3.22 Affected: 3.23 Affected: 3.24 Affected: 3.25 Affected: 3.26 Affected: 3.27 Affected: 3.28 Affected: 3.29 Affected: 3.30 Affected: 3.31 Affected: 3.32 Affected: 3.32.0 Affected: 3.32.1 Affected: 3.32.2 Affected: 3.32.3 Affected: 3.32.4 Affected: 3.33.0 Affected: 3.34.0-rc1 Affected: 3.34.0-rc2 Affected: 3.34.0-rc3 Affected: 4.0.0-alpha.0 Affected: 4.0.0-alpha.1 cpe:2.3:a:conductor-oss:conductor:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:conductor-oss:conductor:*:*:*:*:*:*:*:*"
],
"modules": [
"PLANNER_CONTEXT_FETCH Task Handler"
],
"product": "conductor",
"vendor": "conductor-oss",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"status": "affected",
"version": "3.1"
},
{
"status": "affected",
"version": "3.2"
},
{
"status": "affected",
"version": "3.3"
},
{
"status": "affected",
"version": "3.4"
},
{
"status": "affected",
"version": "3.5"
},
{
"status": "affected",
"version": "3.6"
},
{
"status": "affected",
"version": "3.7"
},
{
"status": "affected",
"version": "3.8"
},
{
"status": "affected",
"version": "3.9"
},
{
"status": "affected",
"version": "3.10"
},
{
"status": "affected",
"version": "3.11"
},
{
"status": "affected",
"version": "3.12"
},
{
"status": "affected",
"version": "3.13"
},
{
"status": "affected",
"version": "3.14"
},
{
"status": "affected",
"version": "3.15"
},
{
"status": "affected",
"version": "3.16"
},
{
"status": "affected",
"version": "3.17"
},
{
"status": "affected",
"version": "3.18"
},
{
"status": "affected",
"version": "3.19"
},
{
"status": "affected",
"version": "3.20"
},
{
"status": "affected",
"version": "3.21"
},
{
"status": "affected",
"version": "3.22"
},
{
"status": "affected",
"version": "3.23"
},
{
"status": "affected",
"version": "3.24"
},
{
"status": "affected",
"version": "3.25"
},
{
"status": "affected",
"version": "3.26"
},
{
"status": "affected",
"version": "3.27"
},
{
"status": "affected",
"version": "3.28"
},
{
"status": "affected",
"version": "3.29"
},
{
"status": "affected",
"version": "3.30"
},
{
"status": "affected",
"version": "3.31"
},
{
"status": "affected",
"version": "3.32"
},
{
"status": "affected",
"version": "3.32.0"
},
{
"status": "affected",
"version": "3.32.1"
},
{
"status": "affected",
"version": "3.32.2"
},
{
"status": "affected",
"version": "3.32.3"
},
{
"status": "affected",
"version": "3.32.4"
},
{
"status": "affected",
"version": "3.33.0"
},
{
"status": "affected",
"version": "3.34.0-rc1"
},
{
"status": "affected",
"version": "3.34.0-rc2"
},
{
"status": "affected",
"version": "3.34.0-rc3"
},
{
"status": "affected",
"version": "4.0.0-alpha.0"
},
{
"status": "affected",
"version": "4.0.0-alpha.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T01:00:36.982Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432811 | conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432811"
},
{
"name": "VDB-432811 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432811/cti"
},
{
"name": "CVE-2026-124507 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124507"
},
{
"name": "Submit #1035482 | conductor-oss Conductor up to v3.33.0-rc5 (unfixed as of 2026-09-18; latest stable v3.32.4); runtime proof at released tag v3.32.4, commit 088de237a185caaeb669035a6d75de65d36cab5a (2026-09-10) Server-Side Request Forgery with response read-back",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035482"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj"
},
{
"tags": [
"product"
],
"url": "https://github.com/conductor-oss/conductor/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T11:57:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124507",
"datePublished": "2026-11-09T01:00:36.982Z",
"dateReserved": "2026-11-08T10:52:07.791Z",
"dateUpdated": "2026-11-09T01:00:36.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124500 (GCVE-0-2026-124500)
Vulnerability from cvelistv5 – Published: 2026-11-08 23:30 – Updated: 2026-11-09 14:10
VLAI
EPSS
VEX
Title
Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery
Summary
A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:09 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432805 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432805/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124500 | third-party-advisory |
| https://vuldb.com/submit/1033342 | third-party-advisory |
| https://gist.github.com/Marsh232/ae7fc1a7b4ad1511… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fengoffice | Feng Office |
Affected:
3.11.13.0
Affected: 3.11.13.1 Affected: 3.11.13.2 Affected: 3.11.13.3 Affected: 3.11.13.4 Affected: 3.11.13.5 Affected: 3.11.13.6 Affected: 3.11.13.7 Affected: 3.11.13.8 Affected: 3.11.13.9 Affected: 3.11.13.10 Affected: 3.11.13.11 Affected: 4.2.1.0 Affected: 4.2.1.1 Affected: 4.2.1.2 cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124500",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:09:56.406362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:10:07.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fengoffice:feng_office:*:*:*:*:*:*:*:*"
],
"modules": [
"File Handler"
],
"product": "Feng Office",
"vendor": "Fengoffice",
"versions": [
{
"status": "affected",
"version": "3.11.13.0"
},
{
"status": "affected",
"version": "3.11.13.1"
},
{
"status": "affected",
"version": "3.11.13.2"
},
{
"status": "affected",
"version": "3.11.13.3"
},
{
"status": "affected",
"version": "3.11.13.4"
},
{
"status": "affected",
"version": "3.11.13.5"
},
{
"status": "affected",
"version": "3.11.13.6"
},
{
"status": "affected",
"version": "3.11.13.7"
},
{
"status": "affected",
"version": "3.11.13.8"
},
{
"status": "affected",
"version": "3.11.13.9"
},
{
"status": "affected",
"version": "3.11.13.10"
},
{
"status": "affected",
"version": "3.11.13.11"
},
{
"status": "affected",
"version": "4.2.1.0"
},
{
"status": "affected",
"version": "4.2.1.1"
},
{
"status": "affected",
"version": "4.2.1.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "1marsh1 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T23:30:20.791Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432805 | Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432805"
},
{
"name": "VDB-432805 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432805/cti"
},
{
"name": "CVE-2026-124500 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124500"
},
{
"name": "Submit #1033342 | Fengoffice Feng Office 3.11.8.0 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033342"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Marsh232/ae7fc1a7b4ad151128e6cd4e0db6cf02"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T09:06:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124500",
"datePublished": "2026-11-08T23:30:20.791Z",
"dateReserved": "2026-11-08T08:01:25.653Z",
"dateUpdated": "2026-11-09T14:10:07.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124466 (GCVE-0-2026-124466)
Vulnerability from cvelistv5 – Published: 2026-11-08 13:15 – Updated: 2026-11-09 14:30
VLAI
EPSS
VEX
Title
OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri
Summary
OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:29 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openemr/openemr/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openemr-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124466",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:29:54.867524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:30:14.570Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-mf6h-xc62-9fg4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "openemr",
"vendor": "openemr",
"versions": [
{
"lessThan": "8.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.4.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "EvidentObscurity"
},
{
"lang": "en",
"type": "finder",
"value": "tinyb0y"
},
{
"lang": "en",
"type": "finder",
"value": "giki-shergill"
},
{
"lang": "en",
"type": "finder",
"value": "Xcatolin"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned client_assertion to probe internal services and reach cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T13:15:51.231Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mf6h-xc62-9fg4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-mf6h-xc62-9fg4"
},
{
"name": "VulnCheck Advisory: OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openemr-before-8.4.0-unauthenticated-ssrf-via-oauth2-client-jwks-uri"
}
],
"title": "OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124466",
"datePublished": "2026-11-08T13:15:51.231Z",
"dateReserved": "2026-11-08T02:16:30.558Z",
"dateUpdated": "2026-11-09T14:30:14.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.