metabadger

Metabadger AWS EC2 における SSRF 攻撃を防ぐために、よりセキュアなインスタンスメタデータサービス v2 IMDSv2 への自動アップグレードを実現します。 Metabadger 目的と機能 AWS インスタンスメタデータサービスの現在の利用状況を診断・評価し、その仕組みを理解する インスタンスメタデータサービスの v2 へのアップグレードを準備し、v1 の攻撃ベクトルから保護する インスタンスを IMDSv2 のみを使用するように具体的に更新する機能を提供する 不要なインスタンスでインスタンスメタデータサービスを無効にし、攻撃対象領域を減らす機能を提供する AWS...

CVE-2026-64849

CVE-2026-64849 More POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" POST /api/2.0/mlflow/webhooks/id/test...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding to Steal Cloud Metadata Program Code Python attacker server + vulnerable app !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This simple server resolves any...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

Malicious code in @hrmony/benefit-internetzuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209d5855ea7b92261c91e4f405f0306f268bb92b9ca8f888bfec4d0a84053544 On module import, the package unconditionally beacons to the hardcoded external host...

Malicious code in @hrmony/middlewares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2129e9ecca729ffb0ac23ee07dd5be18f2a853560899599981bc92b19dda4363 On module load, the package queries the AWS instance metadata service at 169.254.169.254 IMDSv2 to enumerate instance identity, region, and network...

Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

EUVD-2026-85172

An Improper Authentication vulnerability in the Apache Doris Frontend FE meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

EUVD-2026-77315

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

CVE-2026-71198

CVE-2026-71198 is a server-side request forgery (SSRF) in OpenStack Glance before 32.0.1 . When the HTTP store backend is enabled, the location API validates only the URL scheme but does not apply import_filtering_opts host restrictions. An authenticated user can add an image location pointing to...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

PT-2026-91757

Name of the Vulnerable Software and Affected Versions Refly versions prior to 1.1.1 Description An issue exists where the server fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can exploit this to force the backend to issue requests t...