Every story tagged Ssrf, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
5 stories · open in the command center
CVE-2026-69250 is a critical vulnerability (CVSS 8.5) in Flowise versions prior to 3.1.3 that allows unauthenticated attackers with high privileges to bypass authorization and perform server-side request forgery (SSRF) attacks, potentially exposing OAuth2 credentials and sensitive token information. Organizations using Flowise for LLM workflow orchestration face immediate risks of credential theft and unauthorized access to downstream systems. This vulnerability underscores the need for IT organizations to establish robust patch management protocols for AI/ML tools and implement network segmentation to limit lateral movement from compromised LLM platforms.
CVE-2026-67311 is a high-severity SSRF vulnerability (CVSS 8.2) in Budibase versions before 3.38.1 that allows authenticated Builder-role users to bypass IP blacklist protections and access internal services and cloud metadata endpoints through malicious HTTP redirects. This vulnerability poses significant risk to organizations using Budibase for data integration, potentially enabling attackers with platform access to exfiltrate sensitive infrastructure information and compromise internal systems. IT organizations must immediately assess their Budibase deployments and implement strict access controls on Builder role assignments while planning urgent upgrades to version 3.38.1 or later.
Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which e...
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.