The newest Server-Side Request Forgery (SSRF) resources are on the Server-Side Request Forgery (SSRF) page. For a reading order instead of a date order, see the Server-Side Request Forgery (SSRF) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-07-07 2026 | InfoSec Community: New Writeup Alert! "The HTTP 303 SSRF Hack : From Python HTTP Client Defaults to AWS Credential Exfiltration." by Alvin Ferdiansyah is now live on IW! Check it out here: #oauth #python #ssrf #bugbountywriteup intermediate | Alvin Ferdiansyah's new writeup, "The HTTP 303 SSRF Hack: From Python HTTP Client Defaults to AWS Credential Exfiltration," is now available. The analysis explores how default Python HTTP client behaviors can lead to SSRF vulnerabilities, ultimately enabling AWS credential exfiltration. This bug bounty writeup is a valuable resource for those interested in OAuth, Python security, and SSRF exploit techniques. |
| 2026-07-05 2026 | CYBER MIND SPACE: Your firewall is useless... If your own server becomes the attacker. That's SSRF. #CyberSecurity #SSRF #AppSec beginner | Server-Side Request Forgery (SSRF) is a critical cybersecurity vulnerability where an attacker exploits an application to make the server send requests to an unintended location. This bypasses firewalls, as the malicious request originates from within the trusted network. Attackers can use SSRF to access internal systems, cloud metadata, or even trigger actions on other servers. The content highlights that even with robust firewalls, an SSRF vulnerability can render them ineffective if the server itself becomes the attacker's tool. |
| 2026-07-04 2026 | ZOWEH: THE ATTACK CHAIN: 1. Whitelist blocks direct internal IPs 2. Found open redirect: /product/nextProduct?path=... 3. Redirect to: 4. Stock checker follows redirect 5. Admin panel accessed successfully! #SSRF #InfoSec intermediate | ZOWEH researchers uncovered an attack chain bypassing an internal IP whitelist. They exploited an open redirect vulnerability in the `/product/nextProduct?path=` parameter. This redirect was then followed by a stock checker, allowing them to access the admin panel successfully. The techniques used highlight the risks of open redirect vulnerabilities when coupled with internal services. |
| 2026-07-04 2026 | ZOWEH: SSRF LAB 5 SOLVED: SSRF with filter bypass via open redirection Goal: Bypass whitelist to access internal admin panel Method: Chain SSRF with open redirect vulnerability #SSRF #BugBounty intermediate | This write-up details the solution to ZOWEH's SSRF Lab 5, which involves bypassing a whitelist to access an internal admin panel. The method used is chaining a Server-Side Request Forgery (SSRF) vulnerability with an open redirection flaw. This technique successfully circumvented the whitelist's restrictions. The post is tagged with #SSRF and #BugBounty, indicating its relevance to security research and bug bounty hunting. |
| 2026-07-04 2026 | ZOWEH: BLACKLIST vs WHITELIST - MASTERED: | Filter | Bypass Method | |--------|---------------| | Blacklist | Encoding IP variations | | Whitelist | URL parsing tricks fragments | Lesson: Whitelists can be bypassed with careful URL manipulation #SSRF #CyberSecurity intermediate | This content explains two security filtering methods: blacklisting and whitelisting. Blacklists block known malicious inputs, which can be bypassed using encoding or IP variations. Whitelists, on the other hand, only allow specific inputs. However, even whitelists can be vulnerable to bypass techniques, particularly through clever URL parsing tricks and fragments. The key takeaway is that whitelists are not foolproof and can be circumvented with careful manipulation, highlighting a vulnerability in Server-Side Request Forgery (SSRF) attacks. |
| 2026-07-04 2026 | ZOWEH: HOW IT WORKS: 1. Server validates against whitelist 2. # (fragment) is ignored in validation 3. But # tells server to go to localhost 4. Admin panel accessed successfully #SSRF #WebSecurity intermediate | This post details a Server-Side Request Forgery (SSRF) vulnerability in ZOWEH. The server validates requests against a whitelist, but it incorrectly ignores the fragment identifier (#). This allows an attacker to craft a malicious URL that bypasses the whitelist by using the # to point the server to localhost. As a result, the attacker successfully accessed the admin panel. |
| 2026-07-04 2026 | ZOWEH: THE BYPASS: Whitelist checks: Used: http://localhost%2523@stock.weliketoshop.net/admin Double encoding (# %2523) tricks the parser #SSRF #InfoSec intermediate | A security researcher, ZOWEH, discovered a bypass of whitelist checks through a Server-Side Request Forgery (SSRF) vulnerability. The exploit involves double encoding the '#' character as '%2523'. This technique tricks the parser, allowing access to a restricted `admin` endpoint at `stock.weliketoshop.net` via a `localhost` URL. The researcher shared this finding on Twitter. |
| 2026-07-04 2026 | ZOWEH: SSRF LAB 4 SOLVED: SSRF with whitelist-based input filter (EXPERT) Goal: Bypass whitelist to access localhost/admin Filter: Only allows Bypass: Double URL-encoded fragment (#) #SSRF #BugBounty intermediate | ZOWEH's SSRF LAB 4, an expert-level challenge, required bypassing a whitelist-based input filter to access localhost/admin. The filter restricted input, but a double URL-encoded fragment (#) was found to be an effective bypass. This technique enabled successful exploitation of the Server-Side Request Forgery vulnerability. |
| 2026-07-04 2026 | ZOWEH: THE BYPASS: Blacklist blocked: localhost 127.0.0.1 admin Bypass used: Decimal IP: 127.1 URL encoding: %61dmin Result: #SSRF #InfoSec intermediate | A security researcher, ZOWEH, discovered a bypass method that circumvents a blacklist intended to block access to "localhost," "127.0.0.1," and "admin." The bypass utilizes a decimal IP address representation of "127.1" and URL encoding for "admin" as "%61dmin." This technique allows for Server-Side Request Forgery (SSRF) vulnerabilities, as indicated by the researcher's result. The information was shared on social media. |
| 2026-07-04 2026 | ZOWEH: SSRF LAB 3 SOLVED: SSRF with blacklist-based input filter Goal: Bypass blacklist to access http://localhost/admin Challenge: Blocks "localhost" "127.0.0.1" and "admin" Solution: Alternative IP formats URL encoding #SSRF #BugBounty intermediate | This SSRF challenge involved bypassing a blacklist filter to access `http://localhost/admin`. The filter blocked direct mentions of "localhost", "127.0.0.1", and "admin". The solution was to utilize alternative IP address formats and URL encoding to circumvent the restrictions and successfully access the target resource. |
| 2026-07-03 2026 | ZOWEH: SSRF LAB 2 SOLVED: Basic SSRF against another back-end system Goal: Find internal admin server IP via SSRF Method: Automated IP scanning with Burp Intruder #SSRF #BugBounty intermediate | ZOWEH: SSRF LAB 2 SOLVED: Basic SSRF against another back-end system Goal: Find internal admin server IP via SSRF Method: Automated IP scanning with Burp Intruder #SSRF #BugBounty https://ift.tt/zm3UX... |
| 2026-07-03 2026 | ZOWEH: RESULT: Discovered internal admin server IP Accessed http://[IP]/admin Deleted carlos LAB SOLVED #SSRF #InfoSec intermediate | A security researcher identified an internal administrator server's IP address via an SSRF vulnerability. They successfully accessed the admin panel at `http://[IP]/admin` and deleted a user named "carlos." This successfully solved the lab challenge, demonstrating expertise in SSRF and InfoSec. |
| 2026-07-03 2026 | ZOWEH: KEY TAKEAWAY: SSRF = Server making requests it shouldn't Always test: http://localhost/ (AWS metadata) Next: SSRF against other back-end systems #SSRF #CyberSecurity beginner | This content highlights Server-Side Request Forgery (SSRF) as a vulnerability where a server makes unintended requests. Key testing targets include `http://localhost/` and AWS metadata. The recommendation is to then explore SSRF vulnerabilities against other back-end systems. This is presented as a crucial point for cybersecurity. |
| 2026-07-03 2026 | ZOWEH: THE ATTACK: 1. Intercept stock check request 2. Change stockApi= stockApi= http://localhost/admin 3. Server fetches admin panel from itself 4. Admin panel revealed! #SSRF #InfoSec intermediate | This describes a Server-Side Request Forgery (SSRF) vulnerability discovered by ZOWEH. The attack involves intercepting a stock check request and manipulating the `stockApi` parameter to point to `http://localhost/admin`. This causes the server to fetch its own admin panel, revealing it. The post highlights the technique using hashtags #SSRF and #InfoSec. |
| 2026-07-03 2026 | ZOWEH: SSRF LAB 1 SOLVED: Basic SSRF against the local server Goal: Access admin panel by exploiting server-side request forgery Method: Modify stockApi parameter to access localhost stockApi= http://localhost/admin] #SSRF #BugBounty intermediate | ZOWEH successfully solved SSRF Lab 1 by exploiting a basic server-side request forgery vulnerability to access an admin panel. The method involved modifying the `stockApi` parameter to target `http://localhost/admin`. This demonstrates a common bug bounty technique for gaining unauthorized access to sensitive areas by manipulating how a server handles requests. The exploit highlights the risks associated with improperly validated user input in API parameters. |
| 2026-07-02 2026 | Sudarshana: CUCM CVE-2026-20230: WebDialer trusts an unauth HTTP request. Pull the hostname from Version.jws?wsdl SSRF into installClusterStatusExecute traverse dirs to drop a rogue Axis descriptor. It deploys a JSP file-writer. Stage-two shell lands as root. #CUCM #SSRF advanced | The CVE-2026-20230 vulnerability in Cisco Unified Communications Manager (CUCM) allows an attacker to exploit the WebDialer. The vulnerability involves trusting unauthenticated HTTP requests, enabling SSRF by pulling hostnames from Version.jws?wsdl. This allows directory traversal to drop a rogue Axis descriptor, leading to the deployment of a JSP file-writer. The exploit culminates in a second-stage shell landing with root privileges. |
| 2026-07-02 2026 | CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) - watchTowr Labs advanced 18 min read | Analysis of CVE-2026-8451, dubbed "CitrixBleed To Infinity And Beyond," details a pre-authentication memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This flaw, which requires the appliance to be configured as a SAML IdP, stems from insufficient input validation during XML attribute parsing. The vulnerability class, previously seen in instances like CVE-2025-5777 and CVE-2026-3055, highlights ongoing memory management concerns within Citrix NetScaler appliances. → labs.watchtowr.com |
| 2026-07-01 2026 | Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) news 2 min read | Writeup of CVE-2026-20230, an SSRF vulnerability in Cisco Unified Communications Manager, detailing its active exploitation to drop webshells and achieve remote code execution. The exploit chain abuses the WebDialer to deploy a rogue Apache Axis service, enabling file writing to the underlying OS, as observed via honeypots and reported by Defused. A public PoC is available, and CISA has added it to their Known Exploited Vulnerabilities catalog. Mitigation involves disabling the WebDialer service. → helpnetsecurity.com |
| 2026-06-30 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf https://ift.tt/AciJaEu |
| 2026-06-29 2026 | Rapid7 Analysis: CVE-2021-21975 news 5 min read | Analysis of CVE-2021-21975 details an unauthenticated server-side request forgery (SSRF) vulnerability in VMware vRealize Operations Manager. This SSRF, when chained with CVE-2021-21983, enables unauthenticated remote code execution. The analysis highlights the vulnerable `/nodes/thumbprints` endpoint and demonstrates how crafted POST requests with specific JSON payloads can be used to exploit the SSRF. Affected versions include 7.0.0 through 8.3.0 of vRealize Operations Manager. → rapid7.com |
| 2026-06-26 2026 | Hugo | DevOps | Cybersecurity : #CVE-2026-12975 - #SSRF in #Apicurio Registry. No auth needed by default. Malicious #XML triggers blind SSRF or #DoS via entity expansion. #CVSS 8.5. Patch unknown - restrict access now. #CVEAlert #infosec #CyberSecurity #cybersecuritytips More detailed info: news | Hugo | DevOps | Cybersecurity 🇱🇻: #CVE-2026-12975 - #SSRF in #Apicurio Registry. No auth needed by default. Malicious #XML triggers blind SSRF or #DoS via entity expansion. #CVSS 8.5. Patch unknown - ... |
| 2026-06-26 2026 | ihavebeenpwned: Spent 3 days chaining an SSRF. Confirmed OOB built a redirect server through Serveo got their client to follow 302s all the way to cloud metadata. IAM credentials territory. Duplicate. Someone found it a month ago. #bugbounty #ssrf intermediate | ihavebeenpwned: Spent 3 days chaining an SSRF. Confirmed OOB, built a redirect server through Serveo, got their client to follow 302s all the way to cloud metadata. IAM credentials territory. Duplicat... |
| 2026-06-24 2026 | Hugo | DevOps | Cybersecurity : #CVE-2026-53755 - #SSRF in #Crawl4ai #Docker API. Proxy bypass allows access to internal services & cloud metadata. #CVSS 8.6. No patch available. Disable Docker #API or restrict #network access immediately. #CVEAlert #infosec @Docker #devsecops #devops #sysadmin #k8s more: news | Hugo | DevOps | Cybersecurity 🇱🇻: #CVE-2026-53755 - #SSRF in #Crawl4ai #Docker API. Proxy bypass allows access to internal services & cloud metadata. #CVSS 8.6. No patch available. Disable Docker #API... |
| 2026-06-23 2026 | The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration advanced 14 min read | Library detailing a universal bucket hijacking technique that impacts multiple cloud service providers (CSPs) like Google Cloud, AWS, and Azure. This method exploits the global namespace risk of cloud storage bucket names, allowing attackers to delete an organization's bucket and recreate it under their own account, thereby rerouting critical logs and sensitive data exfiltration. The library covers the attack flow, including simulations with Google Cloud Logging, Pub/Sub, and Storage Transfer Service, and the necessary permissions for exploitation. → unit42.paloaltonetworks.com |
| 2026-06-21 2026 | Preventing server-side request forgery in Node.js applications beginner 7 min read | Tool for preventing server-side request forgery (SSRF) in Node.js applications, detailing how attackers exploit input tampering and URL manipulation to make unintended server requests. It covers basic and blind SSRF types, referencing a significant Amazon breach. Mitigation strategies include using updated libraries, employing firewalls, sanitizing user input, enforcing URL schemas like HTTP/HTTPS, and creating allowlists for trusted domains, exemplified by code adjustments in an Express and Axios application. → snyk.io |
| 2026-06-20 2026 | Arookiech: For the rest of the month I'll keep learning and focusing on the specific attack syntax till I know every bypass and every method to carry it out. #ssrf #bugbounty Then maybe I'll be able to build my own tool to automate it properly Thank you Jesus again and again intermediate | Arookiech is dedicating the rest of the month to mastering SSRF attack syntax, including bypasses and execution methods. Their goal is to gain such proficiency that they can develop their own tool for automating these attacks. This focus is part of their bug bounty efforts. |
| 2026-06-18 2026 | The Red Agent POV: How it Reasoned its Way to SSRF advanced 7 min read | Library that details a multi-step SSRF exploit against a GCP Cloud Run service. The exploit chains a GitHub URL validation bypass with a double-slash absolute path technique to read sensitive files like `/proc/self/environ` and application source code. The underlying methodology involves iterative attack strategy execution and reflection, focusing on path traversal and URL confusion techniques before the breakthrough bypass. → wiz.io |
| 2026-06-17 2026 | Help Net Security: Microsoft AntiSSRF open-source library helps block server-side request forgery - - @msftsecurity #CyberSecurity #SSRF #AppSec #Microsoft #OpenSource beginner | Microsoft has released AntiSSRF, an open-source library designed to help developers prevent server-side request forgery (SSRF) vulnerabilities in their applications. SSRF attacks occur when an attacker can trick a server into making requests to unintended locations, potentially leading to unauthorized access or data breaches. This new library aims to provide a straightforward solution for developers to identify and mitigate such risks, enhancing application security. |
| 2026-06-17 2026 | Promise queues and batching concurrent tasks in Deno intermediate 12 min read | Library for managing concurrent tasks in Deno, improving efficiency and robustness through promise queues and task batching. It utilizes `Promise.allSettled()` to execute multiple HTTP fetch requests concurrently, demonstrated by fetching package data from the npm registry JSON endpoint, and offers a GitHub repository for complete source-code reference. → snyk.io |
| 2026-06-17 2026 | Microsoft AntiSSRF open-source library helps block server-side request forgery beginner 2 min read | Library that blocks server-side request forgery (SSRF) by validating URLs and network connections for .NET and Node.js applications. Microsoft AntiSSRF acts as a drop-in component to scrutinize untrusted input before outbound requests, preventing attackers from manipulating servers into connecting to internal networks or exposing sensitive data. It allows developers to configure allowed/denied addresses, specify HTTP/HTTPS behavior, and set required/denied headers, with URIValidator components for domain checks against Azure Key Vault and Storage. → helpnetsecurity.com |
| 2026-06-16 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | xHackInSeconds reported a Server-Side Request Forgery (SSRF) vulnerability where a URL field accepted internal IP addresses, including the EC2 metadata service IP (169.254.169.254). This allowed attackers to retrieve IAM role credentials, granting them full access to S3 and RDS resources. The report highlights a critical security flaw in cloud environments. |
| 2026-06-15 2026 | Hugo | DevOps | Cybersecurity : #CVE-2026-47260 - #SSRF in Koel music streaming prior to 9.3.5 Episode enclosure URLs bypass validation allowing server-side request forgery #CVSS 7.7 #infosec #cybersecurity #pentesting #pentesters #CVEAlert #100daysofcybersecurity Detailed info: news | CVE-2026-47260 is a Server-Side Request Forgery (SSRF) vulnerability found in Koel music streaming versions prior to 9.3.5. The vulnerability stems from bypassed validation in episode enclosure URLs, enabling attackers to perform SSRF attacks. This critical issue has a CVSS score of 7.7. |
| 2026-06-15 2026 | Spring Boot 4.1 Adds gRPC Auto-Configuration SSRF Mitigation and Kotlin 2.3 Support news 3 min read | Library provides gRPC auto-configuration for server and client applications, enabling centralized exception handling and custom observation intercepts. It introduces HTTP client SSRF mitigation through an InetAddressFilter, blocking outbound requests to specified address ranges. The update also enhances Kotlin baseline to 2.3, supports lazy datasource connections, propagates @Async context automatically, and improves OpenTelemetry integration with OTLP exemplars and SSL bundle support. Additional features include asynchronous Spring Data JPA bootstrap and configurable Jackson property behavior. → infoq.com |
| 2026-06-15 2026 | How to Mitigate SSRF Vulnerabilities in Go intermediate 3 min read | Technique for mitigating SSRF vulnerabilities in Go, focusing on URL parsing and validation, and restricting outbound requests to trusted hosts. It highlights the importance of validating `tenantID` and `fileID` parameters and employing allowlists for destination domains. The resource also mentions leveraging Snyk Code for static analysis to identify and fix such vulnerabilities early in the development process. → snyk.io |
| 2026-06-14 2026 | IMDS Abused: Hunting Rare Behaviors to Uncover Exploits intermediate 10 min read Recon | Library for detecting anomalous Instance Metadata Service (IMDS) usage, aiding in the hunt for cloud exploits. This approach led to the discovery of a zero-day SSRF vulnerability in pandoc (CVE-2025-51591), leveraged through an <iframe> tag to target sensitive IMDS endpoints like `/latest/meta-data/iam/info`. It prioritizes rare IMDS access patterns from unexpected processes and focuses on suspicious metadata paths. → wiz.io |
| 2026-06-12 2026 | Building Another Vulnerable Lab — SSRF. beginner | This blog post is a follow-up to a previous one, detailing how to build a Server-Side Request Forgery (SSRF) lab. The author will guide readers through setting up this vulnerable environment, which will be added to their GitHub repository. The post begins by defining SSRF as a vulnerability where an attacker can cause a server to make unintended requests. → infosecwriteups.com |
| 2026-06-11 2026 | Pre-auth XXE → HTTP SSRF on ArubaOS 8.13.2 closed as "theoretical / no valid PoC" despite TCP pcap, sshd localhost log, and internal port scan — documenting for community review advanced 2 min read XXE | Writeup documenting a pre-authentication XXE to OOB SSRF vulnerability in ArubaOS 8.13.2.0 LSR. The exploit allows external HTTP connections, internal network enumeration by proxying probes to internal services, and external DTD resolution. Despite providing packet captures, daemon logs confirming server-side execution, and internal port scan results, the finding was closed as theoretical by HPE. This entry details the vulnerability, evidence, and timeline for community review. |
| 2026-06-10 2026 | TechEarl: Cloud metadata SSRF: how one vulnerable URL fetcher reaching the instance metadata endpoint escalates to full cloud account compromise. #CloudSecurity #SSRF intermediate | This article by TechEarl details a vulnerability where a Server-Side Request Forgery (SSRF) in a URL fetcher can lead to the compromise of an entire cloud account. By exploiting a vulnerable URL fetcher that can access the instance metadata endpoint, an attacker can gain unauthorized access to sensitive cloud credentials. This highlights a critical security flaw in cloud environments that allows for escalation from a simple request forgery to full account takeover. |
| 2026-06-09 2026 | C0deRevenant: Turned a McDonald's meme into a Bounty A chatbot that shouldn't have done what it did. SSTI SSRF. Two programs. Two payouts. Full story here : #BugBounty #SSTI #SSRF #InfoSec #HappyHacking intermediate | C0deRevenant discovered vulnerabilities in a McDonald's meme-themed chatbot, leading to two successful bug bounty payouts. The identified issues were Server-Side Template Injection (SSTI) and Server-Side Request Forgery (SSRF). These vulnerabilities allowed the chatbot to perform actions it was not intended to. |
| 2026-06-08 2026 | AI Security Guard: Server-Side Request Forgery: What It Is & How To Fix It beginner | AI Security Guard: Server-Side Request Forgery: What It Is & How To Fix It https://ift.tt/cSCjzlL |
| 2026-06-08 2026 | Update: The Ending of My $500 Loss and Web Cache Poisoning Story. intermediate | The author recounts a personal experience where a $500 loss prompted them to revisit a previously discovered Web Cache Poisoning vulnerability. The initial discovery was documented but later forgotten. This unexpected financial setback led the author back to investigate the bug further, with the aim of resolving outstanding questions and understanding the implications of the vulnerability, ultimately turning a loss into a learning opportunity. → infosecwriteups.com |
| 2026-06-06 2026 | Hi: callback services like pingback are criminally underrated. the gap between "suspicious behavior in a black box" and "here's the TCP transcript source IP and timing" is literally the difference between a triaged $4k report and a dup-closed nothing-burger. #bugbounty #SSRF intermediate | Callback services like pingback are crucial but often overlooked in bug bounty hunting. Demonstrating suspicious behavior with detailed evidence, such as TCP transcripts, source IP, and timing, is the key differentiator between a valuable, triaged report and a dismissed one. This level of detail can turn a potential "nothing-burger" into a significant bounty, with the example given highlighting a $4k payout for such a well-supported finding related to SSRF vulnerabilities. |
| 2026-06-06 2026 | Thinkkun: SSRF turns your server into an attacker's proxy. One URL preview feature = stolen AWS credentials in 2 requests. Blocklisting IPs fails -- 0x7f000001 2130706433 and [::1] all hit localhost. Use allowlists. #Pentesting #SSRF #Websecurity #Security #Linux intermediate | Thinkkun's URL preview feature suffers from a critical Server-Side Request Forgery (SSRF) vulnerability. This flaw allows attackers to leverage the server as a proxy, potentially leading to the theft of AWS credentials in just two requests. Traditional IP blocklisting methods are ineffective as attackers can bypass them by targeting localhost using various representations like `0x7f000001`, `2130706433`, and `[::1]`. The recommended mitigation is to implement allowlists instead of blocklists to prevent unauthorized server requests. |
| 2026-06-05 2026 | CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise news 4 min read | Writeup of CVE-2026-20230, a critical SSRF vulnerability in Cisco Unified CM and SME, enabling root-level compromise through arbitrary file writes. Exploitation requires the WebDialer service to be enabled, though it is disabled by default. Public Proof-of-Concept exploit code exists, making patching or disabling WebDialer the recommended immediate actions. Targeted monitoring for SSRF and post-exploitation signals can also aid defenders. → socradar.io |
| 2026-06-04 2026 | Doyensec: A #security update for #safeurl addressing an #SSRF bypass in non-default configs affecting those with IPv6 support enabled. A fix was released within 12 hours of report. Upgrade to version 0.2.4: Thanks to @tonghuaroot for the report! #doyensec news | Doyensec has released a security update (version 0.2.4) for safeurl to address an SSRF bypass vulnerability. This bypass affects non-default configurations, specifically for users with IPv6 support enabled. A fix was deployed within approximately 12 hours of the vulnerability being reported by @tonghuaroot. Users are advised to upgrade to the latest version. |
| 2026-06-04 2026 | Gray Hats: A critical Cisco Unified CM vulnerability is exposed. This public PoC code disclosure highlights a severe SSRF risk in WebDialer. #Cisco #SSRF #CVE202620230 #WebDialer #Cybersecurity #PoC intermediate | A critical vulnerability in Cisco Unified Communications Manager (CM) has been publicly disclosed, featuring proof-of-concept (PoC) code. This exposes a severe Server-Side Request Forgery (SSRF) risk within the WebDialer component, identified by CVE-202620230. The disclosure, originating from Gray Hats, highlights a significant cybersecurity threat for Cisco users utilizing this feature. |
| 2026-06-03 2026 | How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential Theft intermediate 13 min read | Writeup of a real-world attack chaining Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and AWS credential theft via an unauthenticated Model Context Protocol (MCP) server. This finding highlights the rapid adoption of MCP for AI integrations, outpacing security maturity and leaving systems vulnerable to exploitation, as demonstrated by the theft of live AWS IAM credentials and database secrets from a customer environment. → cloudsek.com |
| 2026-06-02 2026 | How an Unauthenticated MCP Server Led to SSRF LFI and AWS Credential Theft intermediate 13 min read | Library for discovering and analyzing security risks in AI integrations. It highlights vulnerabilities in Model Context Protocol (MCP) servers, such as Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI), demonstrated by a real-world case study where an unauthenticated MCP server led to AWS credential theft. The library addresses the growing attack surface created by rapid AI adoption and the security maturity gap in new AI-native technologies. → cloudsek.com |
| 2026-06-02 2026 | xHackInSeconds: URL field accepted internal addresses. 169.254.169.254. IAM role credentials in the response. Full S3 and RDS access. #infosec #cloud #ssrf intermediate | xF HackInSeconds discovered a vulnerability where a URL field accepted internal IP addresses, including the metadata service address 169.254.169.254. This allowed attackers to retrieve IAM role credentials from the response. With these credentials, they gained full access to S3 buckets and RDS instances. This highlights a critical Server-Side Request Forgery (SSRF) flaw in cloud environments. |
| 2026-06-02 2026 | Hi: that NASA XXE chain is filthy. multiline DOCTYPE bypass SSRF chaining to get AWS metadata is exactly the kind of creative attack chain that gets $50k bounties. insane find honestly #WebSecurity #SSRF advanced | A researcher discovered a "filthy" XXE (XML External Entity) chain attack against NASA. This sophisticated attack involves a multiline DOCTYPE bypass to achieve SSRF (Server-Side Request Forgery), ultimately enabling the retrieval of AWS metadata. This type of creative attack chain is highly valued in bug bounty programs, with potential payouts exceeding $50,000. The find is described as "insane" and highlights advancements in web security exploitation. |