CVE-2026-72552

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dubinc/dub

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de falsificación de petición del lado del servidor en Dub, con fecha del 10-07-2026, permite a atacantes remotos no autenticados hacer que el servidor emita peticiones HTTP a hosts internos o externos arbitrarios a través del punto final ’metatags edge’. El punto final recupera cualquier URL proporcionada por el solicitante sin aplicar una lista de denegación ni requerir autenticación. Un atacante puede usar esto para escanear servicios internos o exfiltrar datos de puntos finales de metadatos en la nube.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72552

Mitre link : CVE-2026-72552

CVE.ORG link : CVE-2026-72552

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-72552", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72552", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T15:15:24.094728Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Dub", "product": "Dub", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026-07-10"}]}]}], "published": "2026-08-11T12:17:40.860", "references": [{"url": "https://github.com/dubinc/dub", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints."}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en Dub, con fecha del 10-07-2026, permite a atacantes remotos no autenticados hacer que el servidor emita peticiones HTTP a hosts internos o externos arbitrarios a trav\u00e9s del punto final \u2019metatags edge\u2019. El punto final recupera cualquier URL proporcionada por el solicitante sin aplicar una lista de denegaci\u00f3n ni requerir autenticaci\u00f3n. Un atacante puede usar esto para escanear servicios internos o exfiltrar datos de puntos finales de metadatos en la nube."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}