PYSEC-2026-3905 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summary praisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The function hostisblocked validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including publ...

PYSEC-2026-3898 praisonaiagents web_crawl vulnerable to SSRF via redirect-following

Summary webcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...

MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

crewai-tools SSRF redirect bypass exposes internal services

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...

PT-2026-89629

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Improper validation of user-supplied URLs allows a remote attacker to obtain sensitive information from internal network resources. This issue is a Server-Side Request Forgery SSRF,...

CVE-2026-81213: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

PT-2026-89650

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery SSRF. The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects...

PT-2026-89407

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...

PT-2026-89403

OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...

GHSA-5X7X-4C3C-QF5W Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...

CVE-2026-87996

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-88001 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87996

Open WebUI (self-hosted AI platform), versions 0.9.6 through 0.11.1 , is affected by an SSRF via DNS rebinding in the SafePlaywrightURLLoader component (backend/open_webui/retrieval/web/utils.py). The root cause is a trust mismatch: a user-controlled hostname is validated in Python, but the Playw...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

CVE-2026-87996 Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/openwebui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and...

LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

GHSA-PQQC-8V73-9GG2 LF Edge eKuiper: SSRF in External Service

Summary Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud...

DRUPAL-CONTRIB-2026-151

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...