CVE-2026-3270 Overview
CVE-2026-3270 is a Server-Side Request Forgery (SSRF) vulnerability affecting PSI Probe versions up to 5.3.0. The flaw resides in the lookup function of psi-probe-core/src/main/java/psiprobe/tools/Whois.java, which is part of the Whois component. An authenticated remote attacker can manipulate input to coerce the server into issuing arbitrary outbound requests. The exploit details have been disclosed publicly. According to the disclosure, the vendor was contacted but did not respond. PSI Probe is an open-source Apache Tomcat management and monitoring tool, so exposure depends on whether the administrative interface is reachable by untrusted users.
Critical Impact
An authenticated attacker can abuse the Whois lookup feature to send server-originated requests to internal network resources, enabling reconnaissance and limited interaction with services behind the firewall.
Affected Products
- PSI Probe versions up to and including 5.3.0
- psi-probe-core module containing Whois.java
- Apache Tomcat instances managed by vulnerable PSI Probe deployments
Discovery Timeline
- 2026-02-27 - CVE-2026-3270 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-3270
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery [CWE-918]. PSI Probe exposes a Whois lookup utility implemented in the lookup function within psi-probe-core/src/main/java/psiprobe/tools/Whois.java. The function accepts user-supplied input that is used to construct an outbound network request without sufficient validation of the destination. An attacker with low-privileged access to the PSI Probe interface can supply a host or address that points to internal infrastructure rather than a legitimate Whois server. The server then initiates the connection on the attacker's behalf, exposing internal services that would otherwise be unreachable from the public network.
Root Cause
The root cause is missing destination validation in the lookup function. User-controlled values flow into network connection logic without an allowlist of permitted Whois endpoints or filtering of internal IP ranges. The Whois protocol uses TCP port 43, but redirecting the connection to arbitrary hosts and ports allows the server to act as a proxy for attacker-defined traffic.
Attack Vector
The attack requires network access to the PSI Probe management interface and authenticated session with at least low privileges. An attacker submits a crafted Whois lookup request specifying an internal host or non-Whois service as the target. PSI Probe issues the connection from its own network position, returning response data or connection metadata that reveals the existence and behavior of internal systems. This can be used to map internal networks, fingerprint services, or interact with metadata endpoints in cloud environments.
No verified public exploit code is included in the advisory. The disclosure references a public issue report; see the GitHub Public Issue Report and VulDB entry #347994 for additional technical context.
Detection Methods for CVE-2026-3270
Indicators of Compromise
- Outbound TCP connections from PSI Probe hosts to destinations on ports other than 43 (the standard Whois port).
- Whois lookup requests in PSI Probe access logs containing internal IP addresses, RFC1918 ranges, or cloud metadata endpoints such as 169.254.169.254.
- Unexpected authenticated requests to the Whois lookup endpoint from low-privileged accounts.
Detection Strategies
- Inspect PSI Probe HTTP access logs for invocations of the Whois lookup feature and correlate target parameters against expected Whois servers.
- Monitor egress traffic from Tomcat hosts running PSI Probe and alert on connections to internal subnets originating from the JVM process.
- Review authentication logs for unusual session activity preceding Whois lookup invocations.
Monitoring Recommendations
- Deploy network-level egress filtering and log all outbound connections from application servers hosting PSI Probe.
- Forward PSI Probe and Tomcat logs to a centralized SIEM or data lake for correlation with network telemetry.
- Establish a baseline of normal Whois lookup destinations and alert on deviations.
How to Mitigate CVE-2026-3270
Immediate Actions Required
- Restrict access to the PSI Probe management interface to trusted administrators using network ACLs and authentication controls.
- Disable or remove the Whois lookup feature if it is not required for operations.
- Audit existing PSI Probe accounts and remove or downgrade unnecessary privileges.
Patch Information
No vendor patch is referenced in the available advisory data. The disclosure notes that the vendor was contacted but did not respond. Organizations should monitor the PSI Probe project repository for updates beyond version 5.3.0 and apply fixes when released.
Workarounds
- Block outbound TCP traffic from PSI Probe hosts to internal network ranges and cloud metadata endpoints at the firewall level.
- Place PSI Probe behind a reverse proxy that filters or restricts access to the Whois lookup endpoint.
- Run PSI Probe in a network segment without routable access to sensitive internal services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
