The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-09-03 2026 | SonicWall SMA1000 Hit by Second Zero-Day Chain in Seven Weeks Same SSRF-to-Injection Pattern news 2 min read | Writeup detailing a second zero-day chain against SonicWall SMA1000 appliances (CVE-2026-83548 and CVE-2026-83549), involving pre-auth SSRF and post-auth OS command injection. This chain mirrors July's SSRF-to-injection attacks (CVE-2026-15409/15410), which utilized ROOTRUN and KNUCKLEBALL. Affected models require immediate patching to specific versions due to active exploitation and a lack of published IoCs. → cryptorank.io |
| 2026-09-03 2026 | Cybendium: MLflow vérifiait l'adresse de ses webhooks à la configuration. La livraison elle suit les redirections sans revérifier. Un 302 vers 169.254.169.254 et les jetons cloud reviennent dans la réponse. CVE-2026-64849 exploitée en quelques heures : #SSRF intermediate | MLflow had a vulnerability (CVE-2026-64849) where it would verify webhook addresses during configuration but fail to re-verify them during delivery. This allowed an attacker to redirect a webhook to a cloud metadata endpoint (169.254.169.254) using a 302 redirect, subsequently retrieving cloud tokens. This Server-Side Request Forgery (SSRF) vulnerability was exploited within hours of its discovery. |
| 2026-09-03 2026 | The Validator Can Lie: SSRF Beyond URL Validation (GitLab, Mealie, Apache ShenYu, Thumbor) intermediate 44 min read | Analysis of SSRF bypasses across Mealie, GitLab, Apache ShenYu, and Thumbor reveals that URL validation alone is insufficient. Failures occur after parsing, during resolution, object construction, redirect handling, or authority emission, where the validated destination can be lost. This research details twelve failure families across six handoffs between security checks and socket connections, demonstrating how different resolver interfaces, dual-stack DNS, NAT64, and mutated URL components can lead to unexpected connections to internal or unauthorized hosts, even when initial validation passes. |
| 2026-09-02 2026 | 1-Click ATO Via Host Header Injection: Exploiting Password Reset Poisoning. intermediate AuthN | A bug bounty hunter discovered a Host Header Injection vulnerability that enabled a one-click Account Takeover (ATO) by exploiting password reset poisoning. Initially appearing ordinary, the vulnerability's impact became clear when tracing the password reset process. The attack hinges on the victim. → infosecwriteups.com |
| 2026-09-01 2026 | Nozarashi: 6x SSRF in a row #bugbounty #cybersecurity #ssrf #CyberSecurity @Hacker0x01 intermediate | This post highlights a successful bug bounty hunt where Nozarashi discovered six Server-Side Request Forgery (SSRF) vulnerabilities consecutively. The content, shared on social media, emphasizes the cybersecurity aspect of finding these flaws. |
| 2026-08-28 2026 | Nozarashi: 6x SSRF in a row #bugbounty #cybersecurity #ssrf #CyberSecurity @Hacker0x01 intermediate | This bug bounty report highlights a researcher named Nozarashi who discovered six Server-Side Request Forgery (SSRF) vulnerabilities consecutively. The report, shared on HackerOne, emphasizes the cybersecurity aspect of these findings. |
| 2026-08-28 2026 | Sentry MCP Server SSRF Exposes How Agent Trust Chains Become Attack Vectors intermediate 3 min read | Library for securing applications against Server-Side Request Forgery (SSRF) vulnerabilities, specifically detailing CVE-2026-81421 in Sentry MCP Server. This vulnerability allows attackers to force the server to call arbitrary endpoints via the raw_sentry_api, with a reported CVSS score of 7.3 and potential for 9.0. The analysis highlights systemic risks, with 36.7% of scanned MCP servers vulnerable and 41% lacking authentication, creating attack vectors for crypto infrastructure and DeFi integrations, echoing agentjacking research from DEF CON 34. → cryptorank.io |
| 2026-08-27 2026 | CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs news 2 min read | Writeup detailing the exploitation of SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 by ransomware gangs. These flaws, including a severe SSRF vulnerability, were actively exploited in zero-day attacks before patching and have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actor UTA0533 deployed malware like KNUCKLEBALL and Sou5, with attacks linked to INC Ransomware affiliates and prior exploitation of CVE-2025-40602 for privilege escalation. → bleepingcomputer.com |
| 2026-08-26 2026 | CCB Alert: Warning: High SSRF in #JFrog #Artifactory. CVE-2026-70551 CVSS: 8.5. An authenticated repository reader can trigger VCS remote download requests leading to server-side #SSRF! Upgrade to 7.161.19 or 7.146.36. #Patch #Patch #Patch news | A critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-70551, has been identified in JFrog Artifactory with a CVSS score of 8.5. An authenticated repository reader can exploit this by triggering VCS remote download requests, potentially compromising the server. Users are strongly advised to upgrade to versions 7.161.19 or 7.146.36 to patch this high-severity issue. |
| 2026-08-25 2026 | Ali: CVE-2026-70551 in JFrog Artifactory enables SSRF via VCS remote download. Attackers can force internal network requests and steal data. Patch now and lock down VCS URLs. #Infosec #Artifactory #SSRF #ZeroDay #CyberRisk intermediate | JFrog Artifactory is vulnerable to CVE-2026-70551, an SSRF flaw allowing attackers to make internal network requests by exploiting the VCS remote download feature. This could lead to data theft. Users are advised to patch immediately and secure their VCS URLs to mitigate this risk. |
| 2026-08-24 2026 | First Numismatic: You pasted a URL into your profile. The server fetched it and behind your firewall it reached internal APIs and cloud credentials. SSRF doesn't come from outside. Your own server does the reaching. You didn't get hacked. Your server fetched. #SSRF #CyberSecurity #InfoSec intermediate | A vulnerability called Server-Side Request Forgery (SSRF) was discovered where a server fetching a URL from a user's profile accessed internal APIs and cloud credentials behind a firewall. This means the attack originated from the server itself, not from external sources. The user's system was not directly compromised, but their server performed the unauthorized data retrieval. |
| 2026-08-24 2026 | How 8 of the Top 20 HackerOne SSRF Reports Escalated to Cloud Credentials Leaks intermediate | Eight of the top 20 Server-Side Request Forgery (SSRF) reports on HackerOne led to cloud credential leaks. This highlights a significant vulnerability where SSRF flaws can be exploited to gain unauthorized access to sensitive cloud infrastructure and data. These findings underscore the critical importance of robust SSRF mitigation strategies for organizations relying on cloud services. |
| 2026-08-22 2026 | Wordpressvulnerability: Vulnerabilidad crítica en Mailgun for WordPress (2.2.0): SSRF sin autenticación permite tomar control de cuentas admin. CVSS 9.8. Afecta 80k sitios. Actualiza a 2.2.1 #WordPress #Security #SSRF news | A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress (versions up to 2.2.0) allows unauthenticated attackers to gain administrative account control. This flaw impacts approximately 80,000 websites. Users are strongly advised to update to version 2.2.1 or later immediately to patch this severe security risk. |
| 2026-08-20 2026 | Active Exploitation of MLflow SSRF Vulnerability (CVE-2026-64849) Enables Cloud Credential Theft and Account Compromise news 5 min read | Writeup of CVE-2026-64849, an MLflow SSRF vulnerability actively exploited by financially motivated attackers. This flaw allows unauthenticated remote attackers to issue arbitrary HTTP requests from the MLflow Tracking Server, enabling theft of cloud credentials from metadata endpoints like AWS's 169.254.169.254, GCP's metadata.google.internal, and Azure's metadata. The vulnerability affects MLflow versions prior to 3.15.0 and is included in CISA's Known Exploited Vulnerabilities catalog. Mitigation involves upgrading MLflow, restricting network access, and rotating compromised credentials. → rescana.com |
| 2026-08-20 2026 | How an AutoGPT Email Block Became an SSRF Surface intermediate | An AutoGPT component designed to block emails was discovered to be a Server-Side Request Forgery (SSRF) vulnerability. This flaw allowed an attacker to potentially manipulate requests made by AutoGPT. The specific details of the exploit and its impact are outlined in the provided link. → hackernoon.com |
| 2026-08-19 2026 | CVETodo: Cybersecurity and Infrastructure Security Agency added a critical server-side request forgery vulnerability in MLflow to its Known Exploited Vulnerabilities catalog on August 19 citing evidence of active exploitation... #Mlflow #SSRF #KEV #CVE #InfoSec news | The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical server-side request forgery (SSRF) vulnerability in MLflow to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion on August 19 indicates that there is evidence of this vulnerability being actively exploited. |
| 2026-08-19 2026 | Lucifer: Got a bounty for an SSRF vulnerability reported through @YogoshaOfficial. #BugBounty #Yogosha #SSRF #EthicalHacking #SecurityResearch news | Lucifer successfully identified and reported a Server-Side Request Forgery (SSRF) vulnerability through the Yogosha platform. This ethical hacking effort resulted in receiving a bug bounty payout for their security research. |
| 2026-08-19 2026 | Beralock: Critical MLflow SSRF | CVE-2026-64849 MLflow 3.13.0 is affected by an unauthenticated SSRF vulnerability in webhook delivery. Full Advisory PoC: #CyberSecurity #MLflow #SSRF #CVE202664849 #AIsecurity #AppSec news | MLflow versions up to and including 3.13.0 are susceptible to a critical, unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery feature. This flaw, identified as CVE-2026-64849, could allow attackers to exploit the system without needing prior authentication. A full advisory and proof-of-concept (PoC) are available. |
| 2026-08-18 2026 | Daily CyberSecurity: A public PoC for CVE-2026-64849 an unauthenticated MLflow SSRF (CVSS 9.3) is now live. watchTowr reports exploitation attempts. Patch to 3.15.0. #MLflow #CVE202664849 #SSRF #watchTowr #AISecurity #InfoSec news | A public Proof of Concept (PoC) for CVE-2026-64849, a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MLflow (CVSS 9.3), has been released. watchTowr is observing exploitation attempts. Users are strongly advised to patch their MLflow installations to version 3.15.0 to mitigate this severe security risk. |
| 2026-08-17 2026 | Hacking Millions of Modems (and Investigating Who Hacked My Modem) intermediate 24 min read XXE | Writeup detailing the investigation into intercepted and replayed HTTP traffic originating from a home network, ultimately tracing the cause to a compromised Cox Panoramic Wifi gateway modem. The author's investigation identified an IP address (159.65.76.209) previously associated with phishing campaigns targeting ISG Latam and hosting mail server domains. After replacing the modem, the issue ceased, leading to the conclusion that the ISP-provided device was the source of the compromise, though firmware analysis was prevented by ISP policy. → samcurry.net |
| 2026-08-17 2026 | Navigating Lax Load Balancers: When an Intersection Gets You Inside intermediate 7 min read AuthZ | Analysis of AWS Elastic Load Balancer (ELB) misconfigurations, focusing on Application Load Balancers (ALBs) and Network Load Balancers (NLBs). It details vulnerabilities like CloudFront/WAF bypass via direct ALB access, rule shadowing causing authentication bypass, and IP gate bypass via alternate ALBs. The analysis highlights that routing logic and actual traffic paths, not just static configuration, determine exposure, and provides actionable questions for auditors and developers to identify and prevent these issues. → blog.doyensec.com |
| 2026-08-15 2026 | AWS Cloud Security Challenge: SSRF, IMDSv2, and Cloud Takeover intermediate AuthZ | This Fampay CTF challenge involves exploiting a web application hosted on AWS. The goal is to gain access to sensitive data within an S3 bucket by exploiting a vulnerability on an EC2 instance running a Monitoring Dashboard. The content hints at Server-Side Request Forgery (SSRF) and the use of IMDSv2 as potential attack vectors for cloud takeover. → infosecwriteups.com |
| 2026-08-12 2026 | Red Secure Tech Ltd.: An Apache Gravitino SSRF vulnerability allows authenticated attackers to fetch internal metadata and cloud credentials. Patch now. For More: #ApacheGravitino #SSRF #CVE #ServerSideRequestForgery #CloudMetadata #InfoSec #Vulnerability #CyberSecurity news | Red Secure Tech Ltd. has identified a Server-Side Request Forgery (SSRF) vulnerability in Apache Gravitino. This flaw allows authenticated attackers to access internal metadata and sensitive cloud credentials. The company urges users to apply the patch immediately to mitigate this critical security risk. |
| 2026-08-11 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | xHackInSeconds discovered a critical Server-Side Request Forgery (SSRF) vulnerability. The URL field incorrectly accepted internal IP addresses, specifically `169.254.169.254`. This allowed attackers to retrieve IAM role credentials, granting them full access to S3 buckets and RDS instances. |
| 2026-08-10 2026 | Alejandro Cervantes: Para reducir SSRF: allowlists estrictas resolución segura bloqueo de redes internas y controles de salida. Validar solo el texto de la URL no alcanza. #SSRF #AppSec intermediate | Alejandro Cervantes emphasizes that to mitigate Server-Side Request Forgery (SSRF), relying solely on URL text validation is insufficient. Effective strategies include implementing strict allowlists, secure DNS resolution, blocking internal network access, and enforcing egress controls. These measures are crucial for robust application security. |
| 2026-08-10 2026 | Harshvardhan Singh Rathore: I think I found a new ssrf today. But the triagers are too slow maybe i should wait for a month . Hope it will not mark as duplicate. #bugbounty #cybersecurity #ssrf news | Harshvardhan Singh Rathore believes he discovered a new SSRF vulnerability. He expressed concern about slow triagers potentially causing a delay of a month before his finding is reviewed. Rathore hopes his submission won't be marked as a duplicate. The post includes hashtags related to bug bounty and cybersecurity. |
| 2026-08-06 2026 | CRLF-Powered Desync Attacks: Beheading HTTP Streams advanced 24 min read API Sec | Technique detailing CRLF-powered HTTP desync attacks, transforming simple header injection into a wormable exploit. It covers novel methods for detecting and exploiting IP and connection-locked desyncs to achieve cross-network exploitation, generate XSS from thin air, and steal HTTPOnly cookies. Specific techniques discussed include Response Queue Poisoning (RQP) and its application against Content Delivery Networks (CDNs), leveraging Nginx misconfigurations, and exploiting custom headers like X-Original-Url to steal session tokens and access internal infrastructure, as demonstrated by a $20,000 bounty scenario. → portswigger.net |
| 2026-08-03 2026 | Alejandro Cervantes: La defensa contra SSRF necesita validar destino y controlar salida de red. Si la aplicación puede llegar a cualquier lugar una URL se convierte en capacidad. #SSRF #AppSec intermediate | Alejandro Cervantes emphasizes that robust Server-Side Request Forgery (SSRF) defense requires validating destination URLs and controlling network egress. He argues that if an application has the ability to access any location, a URL effectively becomes a gateway for potential exploits. This highlights the critical need for strict validation to prevent unauthorized access and malicious actions. |
| 2026-08-01 2026 | Hugo | DevOps | Cybersecurity : CVE-2026-61953 - Unauthenticated SSRF in Simple Link Directory Pro =15.0.6. CVSS 7.2. No patch available. Mitigate by restricting outbound traffic. #CVE #infosec #SSRF #redteam #blueteam #devsecops #cybersecurity #cybersecuritytips #git #github #gitlab #ethicalhacking news | A critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-61953, has been identified in Simple Link Directory Pro version 15.0.6. With a CVSS score of 7.2, this vulnerability poses a significant risk. Currently, no patch is available. Organizations are advised to mitigate this threat by restricting outbound network traffic. |
| 2026-08-01 2026 | Root Vuln: Found SSRF on an API endpoint that converts HTML to PDF. Uploaded HTML with an external stylesheet link and the server actually fetched it confirmed via OOB callback. Also tied to a known CVE in the outdated library it's using. Reported responsibly #infosec #bugbounty #SSRF intermediate | A security researcher discovered a Server-Side Request Forgery (SSRF) vulnerability in an API endpoint designed to convert HTML to PDF. By including an external stylesheet link in the uploaded HTML, the researcher confirmed the server fetched the resource via an Out-of-Band (OOB) callback. This vulnerability is linked to a known CVE affecting an outdated library. The issue was reported responsibly. |
| 2026-08-01 2026 | Surya Raj Ghimire: SSRF can turn your trusted backend into an attacker's gateway. My latest article covers Server-Side Request Forgery (SSRF) prevention in ASP net core with practical fintech and Open Banking examples. Read: #SSRF #AppSec #OWASP intermediate | Surya Raj Ghimire's latest article focuses on preventing Server-Side Request Forgery (SSRF) in ASP.NET Core. The piece emphasizes how SSRF vulnerabilities can transform trusted backend systems into entry points for attackers. Ghimire provides practical examples from the fintech and Open Banking sectors to illustrate these concepts. The article is relevant for those interested in application security and OWASP best practices. |
| 2026-08-01 2026 | Surya Raj Ghimire: SSRF can turn your trusted backend into an attacker's gateway. My latest article covers Server-Side Request Forgery (SSRF) prevention in Core with practical fintech and Open Banking examples. Read: #SSRF #AppSec #OWASP intermediate | Surya Raj Ghimire's latest article highlights the dangers of Server-Side Request Forgery (SSRF), which can compromise secure backends. The piece focuses on SSRF prevention within "Core" systems, offering practical examples from the fintech and Open Banking sectors. It emphasizes securing applications against this vulnerability. |
| 2026-08-01 2026 | windshock: AI systems may have no direct internet access but still rely on Artifactory or Nexus for packagesmaking package repositories a new egress boundary. I built repository-ssrf-audit an open-source Codex Skill to analyze it. #ai #skills #SSRF #nexus #Jfrog intermediate | AI systems, even without direct internet access, can expose new security risks through their reliance on package repositories like Artifactory and Nexus. These repositories become potential egress boundaries. To address this, an open-source Codex Skill called `repository-ssrf-audit` has been developed to analyze these vulnerabilities, specifically focusing on Server-Side Request Forgery (SSRF) within package repositories. |
| 2026-07-29 2026 | vulnX: SSRF hunters: your GET request just hit a PUT-only wall (IMDSv2). Here's how you climb over it Most people give up when metadata endpoints demand PUT headers their blind SSRF can't send. Don't. #bugbounty #appsec #ssrf intermediate | vulnX: SSRF hunters: your GET request just hit a PUT-only wall (IMDSv2). Here's how you climb over it 🧵 Most people give up when metadata endpoints demand PUT + headers their blind SSRF can't send. Do... |
| 2026-07-28 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | A vulnerability discovered by xHackInSeconds allowed a URL field to accept internal IP addresses, specifically `169.254.169.254`. This led to the exposure of IAM role credentials within the response. Attackers could exploit this to gain full access to S3 and RDS resources. The report highlights a Server-Side Request Forgery (SSRF) vulnerability in cloud environments. |
| 2026-07-27 2026 | VIEH Group: #ssrf extention bypass if it requires the file to end with .yaml do it: url= http://2852039166/latest/meta-data/iam/security-credentials/target-web-role?a=example.yaml paramter with bypass #bugbounty #bugbountytrics #infosec intermediate | VIEH Group details a Server-Side Request Forgery (SSRF) extension bypass technique. The exploit targets systems that require file extensions, specifically `.yaml`, for requests. By appending `?a=example.yaml` to the URL, an attacker can bypass these extension requirements, potentially accessing sensitive metadata such as IAM security credentials. This finding is shared as a bug bounty tip. |
| 2026-07-25 2026 | SusluSec: #ssrf extention bypass if it requires the file to end with .yaml do it: url= http://2852039166/latest/meta-data/iam/security-credentials/target-web-role?a=example.yaml paramter with bypass #bugbounty #bugbountytrics # intermediate | SusluSec details a Server-Side Request Forgery (SSRF) bypass technique. If a target requires a file to end with the `.yaml` extension, a bypass can be achieved by appending `?a=example.yaml` to the URL. This allows for access to sensitive information, as demonstrated in the example URL targeting AWS metadata. The post emphasizes this as a bug bounty trick. |
| 2026-07-23 2026 | Daily CyberSecurity: Three Next.js vulnerabilities (CVE-2026-64645 CVE-2026-64649 CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now. #Nextjs #SSRF #CVE202664645 #WebSecurity #Vercel news | Three critical Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) have been identified, allowing attackers to perform Server-Side Request Forgery (SSRF) attacks and bypass middleware. Users of Next.js are strongly advised to patch their systems immediately to mitigate these security risks. |
| 2026-07-22 2026 | LLM hacking: CVSS 9.9: an SSRF turned Azure OpenAI into a privilege-escalation proxy an authenticated user could reach internal endpoints from its trusted position. Fixed server-side but the same risk lives in any RAG pipeline you run. #AISecurity #SSRF news | A critical Server-Side Request Forgery (SSRF) vulnerability with a CVSS score of 9.9 allowed authenticated users to exploit Azure OpenAI as a privilege-escalation proxy, accessing internal endpoints. While fixed server-side, this risk persists in any Retrieval-Augmented Generation (RAG) pipeline. The post highlights a significant AI security concern related to SSRF attacks in LLM applications. |
| 2026-07-22 2026 | CVE-2026-63764: SSRF in LMDeploys OpenAI-Compatible API Server news 4 min read | Analysis of CVE-2026-63764, a critical SSRF vulnerability in LMDeploy's OpenAI-compatible API server (≤ 0.14.0), details how unauthenticated attackers can exploit a redirect bypass to pivot to internal services and cloud metadata endpoints like 169.254.169.254. The vulnerability, stemming from insufficient validation of redirect targets, allows attackers to steal credentials and access sensitive internal infrastructure. A fix was merged to main via PR #4734 but has not yet been released in a tagged version, highlighting concerns with maintainer responsiveness. → ox.security |
| 2026-07-21 2026 | Harshvardhan singh: Massive update to HOLE Introducing Sonar OOB Catcher - A built-in engine to catch blind SSRF DNS & HTTP interactions instantly! 1-Click Exploit Generator Audio Alerts Export Evidence Advanced Filtering Repo: #BugBounty #SSRF #Infosec intermediate | Harshvardhan singh has released a significant update to his HOLE tool, introducing the Sonar OOB Catcher. This new engine is designed to instantly detect blind SSRF, DNS, and HTTP interactions. The update also includes a 1-click exploit generator, audio alerts, evidence export, and advanced filtering capabilities, enhancing its utility for bug bounty hunters and security professionals focused on SSRF and infosec. |
| 2026-07-18 2026 | Shawkat Emad: 5 SSRFs in Postman. Different services. Different techniques. Different impacts. One of them was marked Informative because the internal team found it just 1 day before mebut I'll happily take that as proof I was on the right track. #BugBounty #SSRF #CyberSecurity #HackerOne intermediate | Shawkat Emad discovered five Server-Side Request Forgery (SSRF) vulnerabilities in Postman, each utilizing different techniques and impacting various services. While one finding was marked "Informative" as the internal team had discovered it a day prior, Emad views this as validation of their investigative approach. The researcher participated in a bug bounty program for this work. |
| 2026-07-16 2026 | Daily CyberSecurity: CVE-2026-15378 is a blind SSRF in Red Hat OpenShift AI. The guardrails-detectors flaw exposes cloud credentials and Kubernetes secrets. #OpenShiftAI #CVE202615378 #SSRF #RedHat #Kubernetes news | CVE-2026-15378 is a blind Server-Side Request Forgery (SSRF) vulnerability discovered in Red Hat OpenShift AI. Specifically, the "guardrails-detectors" component is affected. This flaw allows for the potential exposure of sensitive cloud credentials and Kubernetes secrets. |
| 2026-07-14 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | A Server-Side Request Forgery (SSRF) vulnerability was discovered where a URL field accepted internal IP addresses, including 169.254.169.254. This allowed attackers to potentially retrieve IAM role credentials. Successful exploitation could grant full access to AWS S3 buckets and RDS databases. |
| 2026-07-10 2026 | Sudarshana: Cornered a headless PDF export that fetched user URLs. Pointed it at 169.254.169.254/latest/meta-data/iam/security-credentials/ and it echoed a role's temp keys. IMDSv2 blocks this: no PUT token no answer. Allowlist the hosts you call denylists miss the IP. #SSRF #IMDSv2 intermediate | A security researcher, Sudarshana, discovered a Server-Side Request Forgery (SSRF) vulnerability in a headless PDF export. By directing the export to a specific AWS IMDSv2 endpoint (169.254.169.254/latest/meta-data/iam/security-credentials/), they successfully retrieved temporary AWS credentials. The researcher notes that IMDSv2's default configuration, which requires a PUT token, prevents this exploitation. They recommend using host allowlists rather than denylists to mitigate such vulnerabilities, as denylists may miss specific IPs. |
| 2026-07-09 2026 | Dev: SSRF: Your ticket to internal networks & cloud metadata! Misconfigs in web apps let you fetch backend resources. Check URL params API endpoints. Ffuf & Burp are your friends. Master it! #SSRF #BugBounty beginner | This content explains Server-Side Request Forgery (SSRF) vulnerabilities. SSRF attacks exploit web application misconfigurations to allow attackers to access internal networks and cloud metadata by fetching backend resources. Key areas to investigate for SSRF include URL parameters and API endpoints. Tools like Ffuf and Burp Suite are recommended for identifying these vulnerabilities. The post encourages mastering SSRF for bug bounty hunting. |
| 2026-07-08 2026 | Hugo | DevOps | Cybersecurity : #CVE-2026-57573 - #SSRF in #Crawl4AI #Docker #API. Streaming paths skip destination validation. Unauthenticated remote access to internal networks. #CVSS 8.6. No patch available. Mitigate immediately. #CVE #infosec #k8s #devops #devsecops #sysadmin #kubernetes news | CVE-2026-57573 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Crawl4AI Docker API. It allows unauthenticated remote attackers to access internal networks due to streaming paths skipping destination validation. With a CVSS score of 8.6, this vulnerability is severe. No patch is currently available, making immediate mitigation crucial for DevOps, cybersecurity, and system administration professionals. |
| 2026-07-08 2026 | Graven - Herald.codes: Hello tout le monde ! Nouvelle video Nouveau format #ssrf #owasp #python news | This content announces a new video from Graven - Herald.codes in a new format, focusing on Server-Side Request Forgery (SSRF), OWASP, and Python. The post includes a link to the video. |
| 2026-07-08 2026 | Daily CyberSecurity: New pretix vulnerabilities include a critical session takeover chain (CVE-2026-13602) and an SSRF API key leak. Update to 2026.5.3 now. #pretix #SessionTakeover #SSRF #CyberSecurity #CVE202613602 #CVE202613603 news | Pretix has released version 2026.5.3 to address two critical vulnerabilities. CVE-2026-13602 is a session takeover chain, and another vulnerability allows for an SSRF API key leak. Users are urged to update immediately to mitigate these security risks. |
| 2026-07-08 2026 | The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration. intermediate 13 min read Secrets | Writeup detailing an HTTP 303 SSRF vulnerability that escalates to AWS credential exfiltration. This exploit chains a user-controlled `token_uri` field in BigQuery service account credentials, an HTTP client with default redirect handling, and the AWS Instance Metadata Service (IMDS). By configuring a server to respond with an HTTP 303 redirect, a POST request to IMDS is implicitly converted to a GET request, allowing the attacker to retrieve temporary IAM credentials for the Kubernetes worker node. → infosecwriteups.com |