CVE-2026-119709

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

EUVD-2026-114114

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CVE-2026-119709

The Grimoire software, prior to version 1.0.0 , is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /api/fetch-metadata POST handler. The root cause is the lack of authentication checks when passing user-supplied URLs to the getMetadata() function. An attacker can submit...

CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CVE-2026-119709: goniszewski grimoire: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata…

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

PT-2026-133643

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

graal (>=0.3.2rc3, <=0.4.1rc3), grimoire-elk (>=0.103.0rc10, <=0.103.2rc2) +8 more potentially affected by CVE-2026-114094 via dulwich (0.20.46)

dulwich PYPI version 0.20.46 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc3, =0.103.0rc10, =0.6.0, =0.2.2rc4, =0.20.0rc6, =0.3.2rc4, =0.2.2rc4, =0.2.2rc4, =0.2.2rc5, =0.4.0rc1, =0.5.0rc2 Source cves:...

grimoire-elk (>=0.55.0, <=0.58.0), grimoirelab (>=0.2.52, <=0.2.53) +4 more potentially affected by CVE-2026-114094 via dulwich (0.21.4.1)

dulwich PYPI version 0.21.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoire-elk =0.55.0, =0.2.52, =0.1.0, =0.13.2, =0.4.5, =0.0.4, =0.0.6 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

graal (>=0.3.2rc1, <=0.3.2rc2), grimoire-elk (>=0.103.0rc1, <=0.103.0rc3) potentially affected by CVE-2026-114094 via dulwich (0.20.42)

dulwich PYPI version 0.20.42 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc1, =0.103.0rc1, =0.103.0rc3 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

graal (>=0.3.2rc1, <=0.3.2rc2), grimoire-elk (>=0.103.0rc1, <=0.103.0rc3) potentially affected by CVE-2026-114095 via dulwich (0.20.42)

dulwich PYPI version 0.20.42 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc1, =0.103.0rc1, =0.103.0rc3 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

grimoire-elk (>=0.55.0, <=0.58.0), grimoirelab (>=0.2.52, <=0.2.53) +4 more potentially affected by CVE-2026-114095 via dulwich (0.21.4.1)

dulwich PYPI version 0.21.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoire-elk =0.55.0, =0.2.52, =0.1.0, =0.13.2, =0.4.5, =0.0.4, =0.0.6 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

graal (>=0.3.2rc3, <=0.4.1rc3), grimoire-elk (>=0.103.0rc10, <=0.103.2rc2) +8 more potentially affected by CVE-2026-114095 via dulwich (0.20.46)

dulwich PYPI version 0.20.46 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc3, =0.103.0rc10, =0.6.0, =0.2.2rc4, =0.20.0rc6, =0.3.2rc4, =0.2.2rc4, =0.2.2rc4, =0.2.2rc5, =0.4.0rc1, =0.5.0rc2 Source cves:...

daktari (>=0.0.92, <=0.0.93), graal (>=0.4.5rc2, <=0.4.5) +10 more potentially affected by CVE-2026-59890 via setuptools (67.7.1)

setuptools PYPI version 67.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - daktari =0.0.92, =0.4.5rc2, =0.104.3rc2, =0.9.0rc1, =0.21.4rc2, =0.3.8rc2, =0.2.8rc2, =0.2.8rc2, =0.2.8rc2, =0.7.0rc1, =0.9.0rc2, =0.9.0 -...

chk (>=0.4.2, <=0.4.3), cinnamon-core (0.1.0) +12 more potentially affected by CVE-2026-59890 via setuptools (67.1.0)

setuptools PYPI version 67.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - chk =0.4.2, =0.7.4, =0.8.0 - perceval 0.21.3 - perceval-mozilla 0.3.7 - perceval-opnfv 0.2.7 - perceval-puppet 0.2.7 - perceval-weblate 0.2...

graal (0.4.5rc1), grimoire-elk (0.104.3rc1) +6 more potentially affected by CVE-2024-6345 via setuptools (67.7.0)

setuptools PYPI version 67.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - graal 0.4.5rc1 - grimoire-elk 0.104.3rc1 - perceval 0.21.4rc1 - perceval-mozilla 0.3.8rc1 - perceval-opnfv 0.2.8rc1 - perceval-puppet...

flexrunner (1.0.9), graal (>=0.4.3rc5, <=0.4.3) +13 more potentially affected by CVE-2024-6345 via setuptools (67.0.0)

setuptools PYPI version 67.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - flexrunner 1.0.9 - graal =0.4.3rc5, =0.104.0rc8, =1.0.2, =0.1.0, =0.21.2rc5, =0.3.6rc5, =0.2.6rc5, =0.2.6rc5, =0.2.6rc5, =1.1.0, =0.6.0rc4,...

datasaku (0.0.8), dovesnap (>=1.1.11, <=1.1.12) +13 more potentially affected by CVE-2026-0994 via protobuf (4.23.0)

protobuf PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - datasaku 0.0.8 - dovesnap =1.1.11, =0.105.0rc2, =0.10.0rc1, =2.2.12, =15.32.0, =3.25.0, =1.7.0, =3.0.0, =0.8.0rc1, =0.10.0rc1, =0.10.0 -...

daktari (>=0.0.92, <=0.0.93), graal (>=0.4.5rc2, <=0.4.5) +10 more potentially affected by CVE-2025-47273 via setuptools (67.7.1)

setuptools PYPI version 67.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - daktari =0.0.92, =0.4.5rc2, =0.104.3rc2, =0.9.0rc1, =0.21.4rc2, =0.3.8rc2, =0.2.8rc2, =0.2.8rc2, =0.2.8rc2, =0.7.0rc1, =0.9.0rc2, =0.9.0 -...

chk (>=0.4.2, <=0.4.3), cinnamon-core (0.1.0) +12 more potentially affected by CVE-2025-47273 via setuptools (67.1.0)

setuptools PYPI version 67.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - chk =0.4.2, =0.7.4, =0.8.0 - perceval 0.21.3 - perceval-mozilla 0.3.7 - perceval-opnfv 0.2.7 - perceval-puppet 0.2.7 - perceval-weblate 0.2...