CVE-2025-11864: NucleoidAI Nucleoid SSRF Vulnerability

CVE-2025-11864 Overview

CVE-2025-11864 is a Server-Side Request Forgery (SSRF) vulnerability in NucleoidAI Nucleoid versions up to 0.7.10. The flaw resides in the extension.apply function within /src/cluster.ts, part of the Outbound Request Handler component. Attackers can manipulate the https, ip, port, path, and headers arguments to force the server to issue arbitrary outbound HTTP requests. The vulnerability is remotely exploitable without authentication or user interaction, and is classified under [CWE-918].

Critical Impact
Unauthenticated remote attackers can coerce the Nucleoid server into issuing arbitrary outbound requests, potentially reaching internal services, cloud metadata endpoints, or other restricted network resources.

Affected Products

NucleoidAI Nucleoid versions through 0.7.10
Component: Outbound Request Handler (/src/cluster.ts)
Function: extension.apply

Discovery Timeline

2025-10-16 - CVE-2025-11864 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11864

Vulnerability Analysis

The vulnerability exists in the extension.apply function defined in /src/cluster.ts. This function processes outbound HTTP requests by accepting user-controlled parameters including the protocol (https), destination ip, port, request path, and headers. Nucleoid does not validate or restrict these inputs before issuing the outbound request. An unauthenticated remote attacker can supply arbitrary destination values to make the server connect to internal-only systems or attacker-controlled endpoints.

SSRF flaws of this nature can be leveraged to probe internal network ranges, query cloud instance metadata services, bypass perimeter firewalls, and exfiltrate response data. Because Nucleoid is a declarative runtime often deployed as a backend service, internal accessibility from the host is typically broad. The EPSS score is 0.05% (percentile 15.66), indicating low observed exploitation activity at this time.

Root Cause

The root cause is missing validation of user-supplied request parameters before they are passed to the outbound HTTP client. The extension.apply function trusts caller-provided destination fields without enforcing an allowlist, denying private address ranges, or restricting protocols. This is a textbook implementation of [CWE-918] Server-Side Request Forgery.

Attack Vector

The attack is performed over the network with low complexity and requires no privileges or user interaction. An attacker submits a crafted request to the Nucleoid API supplying malicious values for https, ip, port, path, and headers. The server then issues the outbound request from its own network context. Targets typically include 169.254.169.254 for cloud metadata, internal admin interfaces, and unauthenticated backend services. Technical details are documented in the GitHub CVE Discovery Document and VulDB entry #328809.

Detection Methods for CVE-2025-11864

Indicators of Compromise

Outbound HTTP requests from the Nucleoid process to private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.169.254.
Unexpected request patterns hitting the Nucleoid API with caller-supplied ip, port, or path parameters targeting internal hosts.
Anomalous DNS lookups from the Nucleoid host for cloud metadata or internal infrastructure hostnames.

Detection Strategies

Inspect application logs for calls into extension.apply containing untrusted destination parameters.
Apply egress traffic monitoring to flag outbound connections from Nucleoid services that violate established baselines.
Correlate inbound API requests with outbound connections originating from the same process to identify SSRF chains.

Monitoring Recommendations

Forward Nucleoid application and host network logs to a centralized analytics platform for correlation and retention.
Alert on outbound connections from application servers to cloud metadata IPs or RFC1918 ranges that fall outside normal operations.
Track exception traces from /src/cluster.ts that indicate failed connections to unusual destinations.

How to Mitigate CVE-2025-11864

Immediate Actions Required

Restrict network egress from hosts running Nucleoid so only required external destinations are reachable.
Block access from Nucleoid hosts to cloud metadata endpoints such as 169.254.169.254 unless explicitly required.
Place Nucleoid behind an authenticated reverse proxy to limit exposure of the Outbound Request Handler to untrusted callers.

Patch Information

No fixed version has been published in the available references at the time of writing. Monitor the NucleoidAI project on GitHub and the VulDB advisory for an updated release beyond 0.7.10 that addresses the SSRF in extension.apply.

Workarounds

Wrap extension.apply calls with an input validation layer that enforces an allowlist of approved destination hosts and ports.
Reject requests where ip resolves to private, loopback, or link-local addresses prior to issuing the outbound call.
Disable or remove the Outbound Request Handler component if outbound HTTP functionality is not required by your deployment.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j DROP