Server-Side Request Forgery (SSRF) in Corteza - #VU156185
Published: October 19, 2026
Vulnerability identifier: #VU156185
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to disclose sensitive information from internal services and cloud metadata endpoints accessible from the Corteza server.
The vulnerability exists due to missing destination address validation in the automation workflow engine's httpRequestHandler.send() function when processing caller-supplied URLs in HTTP Request steps. A remote privileged user can execute an authorized workflow with a specially crafted destination URL to send requests to internal services and retrieve the full response, including its status, headers, and body, to disclose sensitive information such as cloud credentials and internal API data.
Affected software
Corteza
Remediation
Install security update from vendor's website.
Corteza - update to 2026.9.0