CVE-2026-41195 Overview
CVE-2026-41195 is a stored Server-Side Request Forgery (SSRF) vulnerability in mosparo, an open-source spam protection solution for online forms. The flaw exists in the automatic rule package source URL feature in versions prior to 1.4.13. A project member with the editor role can store an attacker-controlled URL that the server subsequently fetches. The server follows HTTP and HTTPS redirects and does not restrict private or loopback destinations. This behavior creates a stored SSRF primitive usable as an internal HTTP probing oracle. The maintainers fixed the issue in mosparo 1.4.13.
Critical Impact
An authenticated editor can coerce the mosparo server into issuing HTTP requests to internal services, exposing the structure and reachability of private network resources.
Affected Products
- mosparo versions prior to 1.4.13
- Self-hosted mosparo instances exposing project editor roles
- Deployments reachable from networks containing internal HTTP services
Discovery Timeline
- 2026-05-12 - CVE-2026-41195 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-41195
Vulnerability Analysis
The vulnerability is classified under [CWE-918] Server-Side Request Forgery. mosparo allows project members holding the editor role to configure an automatic rule package source URL. When the server processes this configuration, it performs an outbound HTTP request to retrieve the rule package. The fetch routine does not validate the destination against an allowlist or block private IP ranges. It also follows redirects without re-validating the target address. An attacker who controls an editor account can persist a URL that points at internal infrastructure or a public host that redirects to an internal address. Subsequent server-initiated requests reach loopback interfaces, RFC1918 subnets, cloud metadata endpoints, and other internal HTTP services.
Root Cause
The root cause is missing destination validation in the rule package fetch logic. mosparo trusts the stored source URL without restricting schemes, hostnames, or resolved IP addresses. The HTTP client follows arbitrary redirect chains, allowing time-of-check to time-of-use bypasses where an initially public URL redirects to a private destination.
Attack Vector
The attack requires network access to the mosparo administrative interface and an account with the editor role on a project. The attacker stores a malicious source URL in the automatic rule package configuration. When mosparo fetches the package, the server emits an HTTP request from its own network position. Differences in response codes, timing, and error messages reveal whether internal targets exist. The attacker uses this oracle to map internal hosts, enumerate services on loopback, or probe cloud metadata endpoints. The vulnerability does not yield direct content exfiltration in the response body but produces sufficient signal for reconnaissance of internal infrastructure.
Detection Methods for CVE-2026-41195
Indicators of Compromise
- Outbound HTTP requests from the mosparo server to private IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Rule package source URLs in project configurations pointing to unexpected or attacker-controlled domains.
- Audit log entries showing editor-role users modifying automatic rule package source URLs.
Detection Strategies
- Inspect mosparo project configurations for automatic rule package source URL values that resolve to internal addresses or short-lived domains.
- Monitor egress proxy and firewall logs for HTTP requests originating from the mosparo host targeting RFC1918, loopback, or link-local ranges.
- Correlate editor account activity with subsequent outbound HTTP fetch events from the application server.
Monitoring Recommendations
- Enable verbose logging on the application server for outbound HTTP client activity, including final resolved destinations after redirects.
- Forward web application audit logs and egress network telemetry to a centralized SIEM for correlation.
- Alert on any mosparo-originated requests to cloud instance metadata services or internal management interfaces.
How to Mitigate CVE-2026-41195
Immediate Actions Required
- Upgrade mosparo to version 1.4.13 or later, where the SSRF is patched.
- Audit existing project configurations and remove any unrecognized automatic rule package source URLs.
- Review the list of accounts holding the editor role and revoke unnecessary privileges.
Patch Information
The vulnerability is fixed in mosparo 1.4.13. Refer to the GitHub Security Advisory GHSA-92fh-26qf-r8rg for fix details and upgrade instructions.
Workarounds
- Restrict editor-role assignments to fully trusted users until the upgrade is applied.
- Place the mosparo server behind an egress proxy that blocks requests to private, loopback, and link-local address ranges.
- Block access to cloud instance metadata endpoints from the mosparo host at the network or host firewall layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
