Loading vulnerability…
SSRF in UniFi Talk Application
CVE-2026-55113 is a server-side request forgery vulnerability in UniFi Talk Application affecting version 5.1.2 and earlier. A network-adjacent attacker can induce the application to make unintended server-side requests, which can be leveraged to trigger denial of service conditions and bypass authentication on certain UniFi Talk API endpoints. The issue is described as affecting specific API endpoint handling within UniFi Talk rather than requiring prior authenticated access.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker on the reachable network to disrupt service availability through denial of service and to bypass authentication protections on certain UniFi Talk API endpoints. Depending on the exposed endpoint behavior, this may permit unauthorized access to functionality that should require authentication.
If you can’t patch tonight, do this now.
No interim workaround information is currently available. The primary mitigation is to apply the vendor-provided update immediately. Where operationally feasible, restrict network exposure of UniFi Talk management and API surfaces to trusted administrative networks only until patching is complete.
Patch, then assume compromise.
Upgrade UniFi Talk Application to version 5.2.2 or later, which contains the vendor's fix for this vulnerability. No more specific code-level remediation details are currently available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.