CVE-2026-11346: linqi SSRF Vulnerability

CVE-2026-11346 Overview

CVE-2026-11346 is a Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi. The flaw is tracked under [CWE-918] and permits authenticated users to coerce the application server into issuing arbitrary HTTP requests on their behalf. By embedding an HTTP Request component inside a custom process, an attacker can target internal hosts and ports that are otherwise unreachable from the public network. Differentiated application responses such as Success, Failed, and 504 Gateway Time-out act as a side channel for port and service discovery. The issue enables internal network reconnaissance from an authenticated context.

Critical Impact
An authenticated attacker can map internal network components by abusing the linqi process engine to send arbitrary HTTP requests and infer host and port states from server responses.

Affected Products

linqi process automation platform (custom process creation feature)
Deployments exposing the HTTP Request component to authenticated users
Refer to the Linqi Security Advisory for version-specific details

Discovery Timeline

2026-06-05 - CVE-2026-11346 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11346

Vulnerability Analysis

The vulnerability resides in the HTTP Request component exposed by the linqi custom process creation feature. Authenticated users can define a process that invokes outbound HTTP calls to a destination URL of their choosing. The server does not restrict the destination to vetted external endpoints, so requests can be aimed at internal IP ranges, loopback addresses, or cloud metadata services. The application returns different states depending on how the target responds, which the attacker observes to enumerate services. A successful TCP connection with an HTTP response yields Success, a refused connection yields Failed, and a silent drop produces a 504 Gateway Time-out. This response oracle converts a feature primitive into a reliable internal port scanner.

Root Cause

The root cause is missing validation of user-supplied URLs in the HTTP Request component. The process engine does not enforce an allowlist of destinations or block requests to private, link-local, or loopback ranges. It also propagates fine-grained backend status information back to the requesting user, creating a usable side channel.

Attack Vector

Exploitation requires network access to the linqi web interface and valid credentials with permission to create or edit processes. The attacker builds a process containing an HTTP Request component pointing at an internal target such as http://10.0.0.5:6379/ or http://127.0.0.1:8080/. Executing the process triggers the server-side HTTP call, and the resulting status reveals whether the port is open, closed, or filtered. Iterating across IP ranges and ports allows full reconnaissance of reachable internal services. No verified public proof-of-concept code is available; see the Linqi Security Advisory for technical details.

Detection Methods for CVE-2026-11346

Indicators of Compromise

Outbound HTTP requests from the linqi application server to RFC1918, loopback, or link-local addresses
Repeated process executions originating from a single user account targeting sequential IP addresses or ports
Application logs showing bursts of Success, Failed, and 504 Gateway Time-out results tied to the HTTP Request component
Unusual creation or modification of custom processes containing HTTP Request components shortly after login

Detection Strategies

Audit linqi process definitions for HTTP Request components and flag those targeting internal address space or cloud metadata endpoints such as 169.254.169.254
Correlate process execution telemetry with web proxy and firewall logs to identify server-initiated scans of internal subnets
Alert on a high volume of distinct destination IPs or ports invoked by a single authenticated user within a short window

Monitoring Recommendations

Forward linqi application and process execution logs into a centralized SIEM for retention and correlation
Monitor egress traffic from the linqi host with network sensors and flag connections that do not match expected business integrations
Track creation, modification, and execution of custom processes per user to baseline normal activity

How to Mitigate CVE-2026-11346

Immediate Actions Required

Apply the vendor remediation referenced in the Linqi Security Advisory as soon as it is available for your deployment
Restrict permission to create or edit custom processes to a minimal set of trusted administrators
Review existing custom processes and remove any HTTP Request components targeting internal address ranges

Patch Information

Linqi has published a security advisory describing the SSRF issue in the HTTP Request component. Operators should consult the Linqi Security Advisory for fixed versions and upgrade instructions, then schedule the upgrade across all production and non-production environments.

Workarounds

Place the linqi application server in a network segment that blocks outbound traffic to internal subnets, loopback, and cloud metadata endpoints by default
Enforce an egress allowlist on the linqi host so the HTTP Request component can only reach approved external services
Normalize backend response handling so that user-visible process results do not distinguish between connection refused, timeout, and successful HTTP responses
Require change review for any new custom process that includes an HTTP Request component

bash

# Example egress restriction at the host firewall (illustrative)
# Block linqi server from reaching private ranges and metadata service
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 169.254.169.254/32 -j REJECT