CVE-2026-111313

Published: Oct 15, 2026Modified: Oct 21, 2026Deferred

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/DaKheera47/job-ops

Source: disclosure@vulncheck.com

https://github.com/DaKheera47/job-ops/blob/v0.13.1/orchestrator/src/server/api/routes/manual-jobs.ts#L124-L150

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/jobops-through-0.13.1-ssrf-via-post-api-manual-jobs-fetch

Source: disclosure@vulncheck.com

https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.