7 matches found
CVE-2026-119709
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...
EUVD-2026-114114
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...
CVE-2026-119709
The Grimoire software, prior to version 1.0.0 , is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /api/fetch-metadata POST handler. The root cause is the lack of authentication checks when passing user-supplied URLs to the getMetadata() function. An attacker can submit...
CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...
CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...
PT-2026-133643
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...
CVE-2026-119709: goniszewski grimoire: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata…
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...