CVE-2026-107394: Indico Flask-Multipass SSRF Vulnerability

CVE-2026-107394 Overview

CVE-2026-107394 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Indico, an open-source event management system that integrates Flask-Multipass for authentication. The flaw exists in versions prior to 3.3.13 and represents an incomplete fix for the earlier CVE-2026-25738. An authenticated event organizer can submit a crafted URL that bypasses the private URL validation logic. The target request is executed server-side, and the response data is returned through affected Indico features. Version 3.3.13 remediates the issue.

Critical Impact
Authenticated event organizers can read data from prohibited internal targets by abusing a URL parser edge case, enabling access to internal network resources and metadata services.

Affected Products

Indico event management platform versions prior to 3.3.13
Deployments integrating Flask-Multipass authentication backends
Self-hosted Indico instances exposing event organizer functionality

Discovery Timeline

2026-10-08 - CVE-2026-107394 published to the National Vulnerability Database (NVD)
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-107394

Vulnerability Analysis

The vulnerability resides in Indico's is_private_url function within indico/util/network.py. This routine is intended to block requests to private IP ranges and internal services. The prior remediation for CVE-2026-25738 did not account for URLs containing backslash characters. Python's urlsplit parser handles backslashes in a way that allows attackers to construct URLs whose hostname component differs from the destination resolved by downstream HTTP client libraries. An organizer submits the crafted URL through an Indico feature that performs a server-side fetch, and the response content is reflected back to the attacker.

Root Cause

The root cause is incomplete input validation [CWE-918] in the URL normalization logic. The original private-address blocklist relied solely on urlsplit(url).hostname, which does not treat backslash sequences consistently with how fetchers resolve the target. This parser-fetcher mismatch permits SSRF against localhost, link-local, or internal metadata endpoints that should otherwise be rejected.

Attack Vector

Exploitation requires an authenticated account with event organizer privileges. The attacker supplies a URL containing a backslash to a feature that triggers a server-side request. Indico's private-URL check accepts the input, and the server retrieves and returns content from the restricted target.

python

# Security patch in indico/util/network.py - Improve private URL check (#7573)
def is_private_url(url):
    """Check if the provided URL points to a private IP address."""
    if '\\' in url:
        return True
    hostname = urlsplit(url).hostname
    if not hostname:
        # invalid url, just consider it private to avoid failing noisly
        ...

Source: GitHub Commit 44540e7. The patch short-circuits validation and treats any URL containing a backslash as private, preventing the parser-fetcher divergence from being exploited.

Detection Methods for CVE-2026-107394

Indicators of Compromise

Outbound HTTP requests originating from the Indico application server destined for 127.0.0.1, 169.254.169.254, or RFC1918 ranges
Indico application logs showing URL submissions from organizer accounts containing \ characters in URL fields
Unexpected responses in event configuration pages that contain content from internal services

Detection Strategies

Review web application logs for POST or PUT requests to organizer-facing endpoints where URL parameters include backslash characters or encoded variants such as %5C
Correlate Indico server egress traffic with internal destinations that organizer features should never contact
Audit the Indico version in use and flag any instance below 3.3.13

Monitoring Recommendations

Enable egress filtering and alert on connections from the Indico host to cloud metadata endpoints and private subnets
Forward Indico application and web server logs to a centralized logging platform for retention and anomaly analysis
Monitor authentication logs for newly created or recently elevated organizer accounts

How to Mitigate CVE-2026-107394

Immediate Actions Required

Upgrade Indico to version 3.3.13 or later, which contains the fix in indico/util/network.py
Restrict event organizer privileges to trusted users and audit existing role assignments
Place the Indico server behind an egress proxy that blocks access to internal networks and cloud metadata services

Patch Information

The fix is published in the Indico Release v3.3.13 and tracked through GitHub Pull Request #7573. Full technical context is available in the GitHub Security Advisory GHSA-2v95-h47v-g4x9.

Workarounds

Block outbound traffic from the Indico host to private IP ranges and cloud metadata IPs at the network layer
Temporarily disable or restrict Indico features that fetch user-supplied URLs until the upgrade is deployed
Enforce network segmentation so the Indico application cannot reach sensitive internal services

bash

# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT