CVE-2026-42261: Legeling Prompthub SSRF Vulnerability

CVE-2026-42261 Overview

CVE-2026-42261 is a Server-Side Request Forgery (SSRF) vulnerability in Legeling PromptHub, an AI toolbox for prompt, skill, and agent management. The flaw affects versions 0.4.9 through versions prior to 0.5.4. The authenticated endpoint POST /api/skills/fetch-remote retrieves a user-supplied URL server-side and reflects up to 5 MB of the response body back to the caller. SSRF protections in apps/web/src/utils/remote-http.ts fail to account for multiple valid IPv6 representations, allowing attackers to reach internal networks. The issue is tracked under [CWE-20] Improper Input Validation.

Critical Impact
Any authenticated user can request internal resources via the PromptHub server, exposing loopback, RFC1918, and link-local addresses. Deployments with ALLOW_REGISTRATION=true allow any internet user to register and exploit the flaw.

Affected Products

Legeling PromptHub versions 0.4.9 through versions before 0.5.4
Deployments using the /api/skills/fetch-remote endpoint
Instances configured with ALLOW_REGISTRATION=true

Discovery Timeline

2026-05-08 - CVE-2026-42261 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42261

Vulnerability Analysis

The vulnerability resides in apps/web/src/routes/skills.ts, which exposes the authenticated endpoint POST /api/skills/fetch-remote. The endpoint fetches arbitrary user-supplied URLs server-side and returns response bodies up to 5 MB to the caller. This behavior creates a classic SSRF primitive when destination validation is incomplete.

The SSRF guard in apps/web/src/utils/remote-http.ts implements an isPrivateIPv6 function intended to block private, loopback, and link-local destinations. The function checks against canonical address forms but does not normalize alternate-but-valid IPv6 representations before matching. As a result, attackers can craft addresses that pass the filter while still resolving to restricted networks.

Authenticated attackers can use the SSRF to enumerate internal services, retrieve cloud metadata, or pivot to RFC1918 and link-local resources. The Exploit Prediction Scoring System currently reflects low real-world exploitation activity, but the bug is straightforward to weaponize.

Root Cause

The root cause is incomplete address normalization in isPrivateIPv6. The function relies on string-based or canonical-form checks that miss IPv4-mapped IPv6 addresses encoded in hexadecimal form. It also misses non-literal representations of the loopback address ::1. Any address that is not literally ::1 bypasses the loopback check, even when it is semantically equivalent.

Attack Vector

An authenticated user submits a crafted URL to POST /api/skills/fetch-remote. The URL contains an IPv6 representation such as an IPv4-mapped IPv6 address in hex form, which resolves to internal IPv4 destinations including 127.0.0.1, RFC1918 ranges, and link-local addresses. The server fetches the resource and returns the response body to the attacker. On deployments with ALLOW_REGISTRATION=true, the precondition collapses to any internet user who can register an account.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-9fhh-fjfg-5mr6 for technical details.

Detection Methods for CVE-2026-42261

Indicators of Compromise

Requests to POST /api/skills/fetch-remote containing IPv6 literals with embedded IPv4 octets in hexadecimal form
Outbound connections from the PromptHub server to loopback, RFC1918, or link-local addresses initiated shortly after /api/skills/fetch-remote calls
Unexpected 5 MB response bodies returned from the fetch-remote endpoint
New user registrations followed immediately by /api/skills/fetch-remote invocations on ALLOW_REGISTRATION=true instances

Detection Strategies

Inspect application access logs for /api/skills/fetch-remote requests with URL parameters containing ::ffff:, bracketed IPv6 literals, or hex-encoded IPv4-mapped forms
Correlate authenticated session activity with subsequent internal network egress from the PromptHub host
Alert on registrations from new accounts that exercise remote-fetch endpoints within minutes of account creation

Monitoring Recommendations

Capture egress traffic from PromptHub application servers and flag destinations within private address space
Enable verbose request logging for the fetch-remote route, including parsed URL host and resolved IP
Monitor cloud instance metadata service (IMDS) access patterns from the PromptHub workload

How to Mitigate CVE-2026-42261

Immediate Actions Required

Upgrade PromptHub to version 0.5.4 or later, which contains the official fix
Set ALLOW_REGISTRATION=false until the upgrade is complete to reduce the unauthenticated attack surface
Audit existing user accounts and recent /api/skills/fetch-remote activity for signs of abuse
Restrict outbound network egress from the PromptHub host to only required destinations

Patch Information

The vendor released the fix in version 0.5.4. Refer to the GitHub Release v0.5.4 and the GitHub Security Advisory GHSA-9fhh-fjfg-5mr6 for full details.

Workarounds

Block the /api/skills/fetch-remote route at a reverse proxy or web application firewall until patching is complete
Apply network-layer egress filtering to deny traffic from the PromptHub host to 127.0.0.0/8, RFC1918 ranges, link-local 169.254.0.0/16, and IPv6 loopback or link-local equivalents
Disable user self-registration by setting ALLOW_REGISTRATION=false on internet-exposed deployments

bash

# Example egress restriction on the PromptHub host (Linux, iptables)
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
ip6tables -A OUTPUT -d ::1/128 -j REJECT
ip6tables -A OUTPUT -d fe80::/10 -j REJECT
ip6tables -A OUTPUT -d fc00::/7 -j REJECT