CVE-2026-101048: Cloudreve SSRF Vulnerability

CVE-2026-101048 Overview

Cloudreve before version 4.17.0 contains a server-side request forgery (SSRF) vulnerability caused by missing OAuth scope enforcement on administrative node test endpoints. The endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader do not require the Admin.Write scope, unlike the related node create, update, and delete routes. An OAuth client authorized with only the Admin.Read scope can submit attacker-controlled node definitions. The Cloudreve server then issues outbound HTTP requests to arbitrary URLs, enabling blind SSRF, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints. The flaw is tracked as an authorization issue [CWE-863].

Critical Impact
An OAuth client limited to the Admin.Read scope can coerce the Cloudreve server into making arbitrary outbound HTTP requests, exposing internal services and signed slave requests.

Affected Products

Cloudreve versions prior to 4.17.0
Deployments exposing the administrative API to OAuth clients
Instances where third-party OAuth integrations have been granted Admin.Read scope

Discovery Timeline

2026-09-27 - CVE-2026-101048 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101048

Vulnerability Analysis

Cloudreve exposes a set of administrative endpoints that manage storage node definitions. Node create, update, and delete routes correctly require the Admin.Write OAuth scope. The node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader were registered without this scope requirement. As a result, an OAuth client authorized by an administrator with only Admin.Read can invoke these endpoints and supply attacker-controlled node configuration data. Cloudreve processes the submitted definition and performs outbound HTTP requests to the specified URL, treating the response as part of a node connectivity test.

Root Cause

The root cause is inconsistent scope enforcement on administrative routes [CWE-863]. The node test handlers were registered on the router without binding the Admin.Write scope that governs other state-changing node operations. Because read-scope tokens can trigger write-like side effects, the authorization model is broken for these specific endpoints.

Attack Vector

An attacker who controls an OAuth client previously granted Admin.Read by a Cloudreve administrator submits a crafted POST request to /api/v4/admin/node/test or /api/v4/admin/node/test/downloader. The request body contains a node definition pointing at an attacker-selected URL, including internal addresses such as metadata services, loopback interfaces, or private-range hosts. Cloudreve generates and sends the outbound request from the server, allowing blind SSRF, internal service probing, and relaying of signed Cloudreve slave-style requests to arbitrary endpoints. No synthetic exploit code is published; refer to the GitHub Security Advisory and the VulnCheck SSRF Advisory for technical details.

Detection Methods for CVE-2026-101048

Indicators of Compromise

Access log entries for POST /api/v4/admin/node/test or POST /api/v4/admin/node/test/downloader originating from OAuth clients that only hold Admin.Read.
Outbound HTTP connections from the Cloudreve server to internal RFC1918 addresses, link-local ranges, or cloud metadata endpoints such as 169.254.169.254.
Unexpected signed Cloudreve slave requests delivered to external hosts not registered as legitimate storage nodes.

Detection Strategies

Correlate OAuth token scope metadata with the administrative endpoints invoked by each client to detect scope mismatches.
Alert on any request to the node test endpoints where the authenticated client lacks Admin.Write.
Baseline normal outbound destinations for Cloudreve and flag requests to new or internal hosts triggered by admin API calls.

Monitoring Recommendations

Forward Cloudreve API access logs and reverse-proxy logs to a centralized logging platform for retention and query.
Enable network egress logging on the Cloudreve host so that server-initiated connections can be mapped back to API requests.
Review the inventory of OAuth clients granted administrative scopes on a recurring schedule.

How to Mitigate CVE-2026-101048

Immediate Actions Required

Upgrade Cloudreve to version 4.17.0 or later, which enforces Admin.Write on the node test endpoints.
Audit all OAuth clients currently authorized with Admin.Read and revoke tokens that are not strictly required.
Restrict network egress from the Cloudreve server so that it cannot reach internal management interfaces or cloud metadata services.

Patch Information

The issue is fixed in Cloudreve 4.17.0. The patch adds the Admin.Write scope requirement to POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader, aligning them with the other node management routes. See the GitHub Security Advisory for the complete fix description.

Workarounds

Block the two affected endpoints at a reverse proxy or web application firewall when the request is made with a token that does not carry Admin.Write.
Place Cloudreve behind an egress proxy that denies connections to private IP ranges and cloud metadata addresses.
Temporarily disable third-party OAuth integrations with administrative scopes until the upgrade is applied.

bash

# Example NGINX rule to block the vulnerable endpoints until patched
location ~ ^/api/v4/admin/node/test(/downloader)?$ {
    return 403;
}