CVE-2026-18647: Jina-AI Reader SSRF Vulnerability

CVE-2026-18647 Overview

CVE-2026-18647 is a Server-Side Request Forgery (SSRF) vulnerability affecting the jina-ai reader project up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. The flaw resides in the isValidTLD function within /backend/functions/src/cloud-functions/crawler.ts, part of the Crawler/Puppeteer component. Attackers can manipulate URL validation logic to coerce the server into issuing requests to unintended internal or external destinations. The exploit has been publicly disclosed. The vendor was contacted before publication but did not respond. Because the project follows a rolling release model, no discrete affected or fixed version numbers are published.

Critical Impact
Remote unauthenticated attackers can abuse the crawler to request arbitrary URLs, enabling internal network reconnaissance and access to metadata services.

Affected Products

jina-ai reader (rolling release)
Builds at or before commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1
Crawler/Puppeteer component (/backend/functions/src/cloud-functions/crawler.ts)

Discovery Timeline

2026-08-03 - CVE-2026-18647 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18647

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under CWE-918. It exists in the isValidTLD routine that gates URLs the Puppeteer-driven crawler will fetch. Because validation is limited to top-level domain checks, it does not enforce restrictions on hostnames, IP literals, or private network ranges. An attacker submits a crafted target URL to the crawler endpoint, and the backend performs the outbound HTTP request on their behalf. This turns the reader service into a proxy for internal resource access, including cloud metadata endpoints, loopback services, and RFC1918 addresses reachable from the host.

Root Cause

The isValidTLD function performs syntactic checks on the domain suffix rather than validating the request target against an allow-list of permitted hosts. Domain-only validation cannot prevent SSRF because attackers control the full hostname and IP resolution. There is no post-resolution check that blocks private, link-local, or loopback addresses before Puppeteer issues the request.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker submits a URL to the crawler function whose registered TLD passes isValidTLD but whose hostname resolves to an internal target, or leverages DNS rebinding, redirects, or IP-based bypasses. The Puppeteer instance then fetches the URL, returning response content or side-channel signals to the attacker. See the GitHub Issue Report and VulDB CVE-2026-18647 entry for reproduction details.

Detection Methods for CVE-2026-18647

Indicators of Compromise

Outbound crawler requests targeting 169.254.169.254, 127.0.0.1, or RFC1918 ranges from the reader backend host.
Unexpected Puppeteer navigation events to non-web-content endpoints such as internal APIs or admin panels.
Bursts of crawler requests originating from a single client IP with varied hostnames resolving to internal addresses.

Detection Strategies

Instrument the crawler.ts handler to log the fully resolved IP for each requested URL and alert on non-public destinations.
Baseline normal outbound crawler traffic and flag deviations in destination ASN, geography, or port usage.
Monitor for DNS resolutions that return private addresses in response to externally supplied hostnames.

Monitoring Recommendations

Forward crawler request logs and egress firewall telemetry to a central SIEM for correlation.
Alert on any crawler-originated request to cloud metadata IPs or internal service ports (e.g., 6379, 9200, 8500).
Track failure-mode responses (HTTP 401/403 from internal services) that suggest probing of authenticated internal endpoints.

How to Mitigate CVE-2026-18647

Immediate Actions Required

Restrict the reader backend's egress network policy to only the domains and ports required for legitimate crawling.
Deploy a URL allow-list or dedicated egress proxy in front of the Puppeteer component that rejects private and link-local targets.
Disable or gate the crawler cloud function behind authentication until upstream changes address the SSRF.

Patch Information

No vendor patch has been published. The project uses a rolling release model, and the vendor did not respond to disclosure attempts. Track the GitHub Issue Report and downstream commits to crawler.ts for remediation of the isValidTLD logic. Until a fix lands, treat any deployment at or before commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1 as vulnerable.

Workarounds

Replace TLD-only validation with post-DNS-resolution checks that reject loopback, link-local, multicast, and RFC1918 addresses.
Route Puppeteer traffic through an isolated network namespace with no route to internal subnets or the cloud metadata service.
Enforce IMDSv2 with hop-limit 1 on cloud instances so SSRF cannot reach instance credentials.

bash

# Configuration example: block metadata and private ranges via iptables on the crawler host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8      -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12   -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16  -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8     -j REJECT