CVE-2026-49345 Overview
CVE-2026-49345 is a Server-Side Request Forgery (SSRF) vulnerability in Mercator, an open source web application used for mapping information systems. The flaw resides in the CVE configuration panel at /admin/config/parameters. The testProvider() method in ConfigurationController passes user-supplied input directly to curl_init() without validating the scheme, hostname, or destination IP address. An authenticated user holding the configure permission can force the Mercator server to issue arbitrary outbound network requests. Version 2025.05.19 patches the issue.
Critical Impact
Authenticated attackers can pivot through the Mercator server to scan internal networks, reach loopback services, and abuse gopher:// to interact with unauthenticated internal services such as Redis or Memcached, potentially achieving remote code execution.
Affected Products
- Mercator (sourcentis/mercator) versions prior to 2025.05.19
- Mercator CVE configuration panel (/admin/config/parameters)
- Deployments exposing internal services like Redis or Memcached on the Mercator host network
Discovery Timeline
- 2026-06-19 - CVE-2026-49345 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-49345
Vulnerability Analysis
The vulnerability is a classic Server-Side Request Forgery [CWE-918] in Mercator's configuration interface. The testProvider() method accepts a URL from an authenticated administrator and feeds it directly into curl_init(). No scheme allowlist, host allowlist, or private and loopback IP block is enforced before issuing the request. The application normally appends /api/dbInfo to the supplied URL to perform a connectivity test against a CVE feed provider. An attacker bypasses this suffix by appending a # fragment character to the input, for example http://TARGET/PATH#, which causes curl to ignore everything after the fragment marker. This gives the attacker full control over the destination URL and path.
Root Cause
The root cause is missing input validation on a user-controlled URL before invoking an outbound HTTP client. The code trusts the configure permission boundary instead of enforcing scheme and destination restrictions in the network layer. Because PHP's curl bindings honor a wide range of protocol handlers by default, any scheme curl understands becomes reachable from the server.
Attack Vector
An authenticated user with the configure permission submits a crafted URL through the CVE configuration panel. Using the telnet:// scheme, the attacker performs internal port scanning by observing response timing and error behavior. Using the gopher:// scheme, the attacker sends arbitrary TCP payloads to internal services that lack authentication, such as Redis or Memcached. Under common Redis deployment patterns, attackers can write crontab entries or module loads through gopher payloads, leading to remote code execution on the backend service host.
No verified public exploit code is available. The vulnerability mechanism is documented in the GitHub Security Advisory.
Detection Methods for CVE-2026-49345
Indicators of Compromise
- Unexpected outbound connections from the Mercator application server to RFC1918 addresses, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254.
- HTTP requests to /admin/config/parameters carrying URLs with non-HTTP schemes such as telnet://, gopher://, file://, or dict://.
- Outbound traffic from the Mercator host to internal Redis (6379), Memcached (11211), or other unauthenticated service ports.
- Request payloads containing the # fragment character used to strip the appended /api/dbInfo suffix.
Detection Strategies
- Inspect web server and application logs for POST requests to /admin/config/parameters and extract the submitted provider URL for scheme and host analysis.
- Alert on any curl-originated traffic from the Mercator process targeting non-routable or loopback destinations.
- Correlate authenticated session activity holding the configure permission with anomalous outbound connection patterns.
Monitoring Recommendations
- Enable egress logging on the Mercator host and flag connections to internal management networks or cloud metadata services.
- Monitor Redis, Memcached, and similar internal services for unexpected commands originating from the Mercator server IP.
- Track configuration changes in ConfigurationController audit trails for repeated provider test attempts.
How to Mitigate CVE-2026-49345
Immediate Actions Required
- Upgrade Mercator to version 2025.05.19 or later, which patches the SSRF in testProvider().
- Restrict the configure permission to a minimal set of trusted administrators until the patch is applied.
- Place the Mercator server behind egress filtering that blocks access to RFC1918 ranges, loopback, and cloud metadata endpoints.
Patch Information
Version 2025.05.19 of Mercator contains the fix. Refer to the GitHub Security Advisory GHSA-6q97-4q5r-96j6 for upgrade details and code changes.
Workarounds
- Revoke the configure permission from non-essential accounts until upgrade is possible.
- Apply a network-level allowlist that only permits the Mercator server to reach known CVE feed provider hostnames over HTTPS on port 443.
- Require authentication on internal services such as Redis and Memcached, and bind them to localhost interfaces unreachable from the application server.
- Deploy a forward proxy that strips non-HTTP schemes and rejects requests targeting private IP ranges.
# Example egress restriction using iptables on the Mercator host
# Drop outbound traffic to private and loopback ranges except DNS
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
