CVE-2026-88983

Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An authenticated caller with permission to create a pipeline or pipeline version can make requests from the API server to internal services and observe a limited status-code oracle. Arbitrary response-body disclosure, credential theft, and integrity or availability impact are not established. This issue is fixed in version 2.17.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubeflow

Products

Pipelines

CVE-2026-88980

Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend GET /artifacts/get route accepts source=http or source=https with caller-controlled bucket and key values, and isAllowedResourceName permits an all-digit decimal host that the URL parser converts to an IPv4 address. The default ALLOWED_ARTIFACT_DOMAIN_REGEX and authorization-disabled standalone configuration allow an unauthenticated caller to fetch internal HTTP resources and receive their response body. In the authenticated multi-user configuration, the same destination-validation defect is reachable by a low-privilege tenant with a valid identity and authorized namespace. Cloud credential disclosure depends on reachable metadata services and attached roles, and the issue does not establish IMDSv2 bypass or credential access when metadata is blocked. This issue is fixed in version 2.18.0.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Kubeflow

Products

Pipelines

CVE-2026-63441

2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bubka

Products

2fauth

CVE-2026-49951

RAGFlow < 0.27.0 SSRF via set_api_key base_url Parameter

RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue requests to arbitrary internal or external endpoints by supplying an unvalidated base_url to the POST /v1/llm/set_api_key endpoint handled by set_api_key() in api/apps/llm_app.py. Attackers can exploit this flaw to probe shared-network services such as MySQL, Elasticsearch, Redis, MinIO, the Infinity vector database, and cloud metadata endpoints, with raw upstream exception text returned in the response leaking internal service details, open ports, and configuration fingerprints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Infiniflow

Products

Ragflow

CVE-2026-123786

Agenta before 0.122.5 SSRF via Workflow Revision URL Leaks Secret Token

Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit rights to redirect workflow invocations by setting arbitrary revision URLs. Attackers can capture the attached secret-resolve Authorization token to read provider secrets from the vault API, or reach internal and cloud metadata addresses.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Agentatech

Products

Agenta

CVE-2026-123207

LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return public addresses during validation and internal addresses at connection time via /api/source/test, /api/proxy, /api/search or /api/detail to reach loopback services, private hosts or cloud metadata endpoints.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Librespark

Products

Libretv

CVE-2026-112337

Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wazuh

Products

Wazuh

CVE-2026-102356

Kroki Mermaid companion SSRF via flowchart image URLs

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Yuzutech

Products

Kroki

CVE-2026-125191

FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff_v4l2_m2m_codec_reinit() wait forever and hang the decoding application.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-111036

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Coupa

Products

Coupa S Total Spend Management Platform Coupa Total Spend Management Platform

CVE-2026-107330

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datastage On Cloud Pak For Data

CVE-2026-102337

Webmin: SSRF exploit in Upload and Download and File Manager modules

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not restricted by resolved IP address. This allows requests to unauthenticated intranet services or cloud-provider instance metadata endpoints that are inaccessible from the user's own system. This issue is fixed in 2.652.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Webmin

Products

Webmin

CVE-2026-123818

LMDeploy URL parser disagreement permits SSRF filter bypass

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Internlm

Products

Lmdeploy

CVE-2026-18869

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-81190

KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF

KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. The default configuration limits this privilege to administrators. The flaw does not permit file writes and does not expose environment variables. This issue is fixed in version 26.1.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kurrent-io

Products

Kurrentdb

CVE-2026-114604

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Ardatan

Products

Graphql-tools

CVE-2026-123204

Posta before v0.18.0 SSRF via Webhook URL

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Goposta

Products

Posta

CVE-2026-123201

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jarun

Products

Buku

CVE-2026-97373

draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An unauthenticated remote attacker can cause the draw.io server to request internal services that are reachable in this range, potentially disclosing data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. This vulnerability is fixed in 30.3.8.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jgraph

Products

Drawio

CVE-2026-122140

Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Germondai

Products

Trawl