Loading story…
Fedify disclosed and patched a high-severity server-side request forgery flaw, tracked as CVE-2026-62857, in the getNodeInfo() function and Context.lookupNodeInfo() method used by ActivityPub server applications. The bug allowed attacker-controlled links[].href values from /.well-known/nodeinfo to be fetched without validating URL schemes, redirect targets, or whether destinations were publicly routable, enabling requests to loopback, link-local, private-network, cloud metadata, and even data: URLs and exposing returned content. The issue is rated CVSS 8.8 and mapped to CWE-918.
The vulnerability affects Fedify versions from 1.2.0 across vulnerable releases in the 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines. Fixes were released in 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2, with the latest release adding checks for both direct requests and redirect hops so NodeInfo fetching now blocks non-public destinations in line with existing WebFinger and document loader protections.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 6, 2026, CVE-2026-62857 was published for a high-severity SSRF vulnerability in Fedify affecting multiple release lines from 1.2.0 onward. The advisory stated the issue was fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2.
On July 15, 2026, Fedify released version 2.3.2, which fixed a server-side request forgery flaw in getNodeInfo() and Context.lookupNodeInfo(). The update added validation for direct requests and redirect hops to block non-public destinations such as loopback, link-local, private, and data: URLs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-49328**, an important-severity server-side request forgery (**SSRF**) vulnerability in Apache Fesod (Incubating) affecting the `fesod-sheet` package before version `2.0.2-incubating`. The flaw resides in the `UrlImageConverter` component, where improper validation of user-supplied image URLs can cause the server to make outbound requests to internal or otherwise restricted resources. The issue was reported by Xu Han and is tracked in Apache Fesod issue or pull request `#917`. The vulnerability could let attackers probe enterprise backend systems or private cloud endpoints that are not directly exposed to the internet, increasing the risk of internal network access and information exposure. Apache has released **version `2.0.2-incubating`** to remediate the bug with stricter validation of user-supplied parameters, and defenders are being urged to upgrade promptly; where immediate patching is not possible, restricting unusual outbound server connections can help reduce exposure.
Jun 29, 2026
A high-severity server-side request forgery flaw tracked as **CVE-2026-10582** affects **Hugo 0.91.0 through 0.165.0**. The issue lies in outbound fetches performed by `resources.GetRemote`, where `security.http.urls` validates only the supplied URL text and some canonicalized IPv4 variants, but does not resolve hostnames or verify the destination IP at connection time. That gap allows attacker-controlled hostnames to pass policy checks even if they ultimately resolve to loopback, private-network, or cloud-metadata addresses. If an attacker can influence a URL through front matter, site content, or a CMS field, Hugo’s build process can retrieve internal resources and embed the response into the generated static site, creating a path for data exfiltration through published artifacts. Hugo’s security code already includes SSRF-focused checks such as blocking localhost-style URL patterns, userinfo in URLs, and alternate IPv4 encodings, but the advisory says those protections do not enforce dial-time destination validation. The vulnerability is classified as **CWE-918** and has been scored **7.4 CVSS v3.1** and **8.3 CVSS v4.0**.
Aug 24, 2026
InternLM's **LMDeploy** OpenAI-compatible API server is affected by **CVE-2026-63764**, a critical server-side request forgery flaw that lets unauthenticated attackers reach internal services by abusing image fetching in the `/v1/chat/completions` endpoint. The bug stems from validating only the initial `image_url` host and then following HTTP `302` redirects without re-checking whether subsequent destinations resolve to private or link-local addresses. As a result, an attacker can supply a public URL that redirects the server to targets such as `127.0.0.1` or the cloud metadata address `169.254.169.254`, potentially exposing internal-only applications and cloud IAM credentials. The vulnerability is tracked as **CWE-918** and has been rated **CVSS 9.2**; one affected build identified in public reporting is LMDeploy git version `648df3b`, while broader reporting says versions through **0.14.0** are impacted. A patch was merged to the main branch in **PR #4734**, but public reporting says no tagged release includes the fix yet. The issue was reportedly disclosed after a 36-day period without maintainer response following an initial report by researcher George Chen, increasing urgency for organizations running LMDeploy to review exposure and apply the upstream fix as soon as a release becomes available.
Jul 22, 2026