CVE-2026-54166: Shelf Asset Tracking SSRF Vulnerability

CVE-2026-54166 Overview

CVE-2026-54166 is a Server-Side Request Forgery (SSRF) vulnerability in Shelf, an open-source platform for tracking physical assets. The flaw affects Shelf versions prior to 1.20.3 and resides in the Asset CSV Content Import feature. Authenticated users holding the asset:import permission can force the server to issue arbitrary HTTP requests to attacker-controlled destinations. The weakness is classified under CWE-918: Server-Side Request Forgery. Version 1.20.3 addresses the issue.

Critical Impact
Authenticated attackers can pivot from the Shelf application to internal network services, cloud instance metadata endpoints, and arbitrary external hosts, and can also trigger memory exhaustion through unbounded response buffering.

Affected Products

Shelf (shelf.nu) versions prior to 1.20.3
Deployments exposing the Asset CSV Content Import feature to users with asset:import permission
Self-hosted and containerized Shelf instances running vulnerable releases

Discovery Timeline

2026-09-11 - CVE-2026-54166 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54166

Vulnerability Analysis

The Asset CSV Content Import feature accepts an imageUrl field for each imported asset row. The server validates the URL, then issues a fetch() request to retrieve the referenced image. The validation logic is insufficient and can be bypassed through several techniques described in the advisory: appending image file extensions to arbitrary URLs, embedding image-related path keywords, matching legitimate image-hosting domains as substrings of attacker-controlled hostnames, and using HTTP redirect chains that terminate at internal targets.

Once validation is bypassed, the server performs an unrestricted outbound request. The response body is fully buffered in memory before any size check is applied, which allows an attacker to induce memory exhaustion by pointing the fetcher at arbitrary large responses.

Root Cause

The root cause is a deny-by-pattern URL validator combined with an unrestricted HTTP client. String-based checks on file extensions, path keywords, and domain substrings do not enforce host allowlists or block private IP ranges. Redirect responses are followed without re-validating the final destination against the same policy, and response size is enforced after full buffering rather than during streaming.

Attack Vector

An authenticated user with asset:import submits a crafted CSV whose imageUrl column targets an internal resource, such as http://169.254.169.254/latest/meta-data/ on AWS, a Kubernetes API endpoint, or an internal admin service. Alternate bypass forms include URLs like https://attacker.example.com/pixel.png that redirect to the internal target, or hostnames such as internal-host.images.attacker.tld designed to satisfy substring-based domain checks. The Shelf server issues the request from its own network context, and response content or response timing can be observed to exfiltrate data or map internal services.

The vulnerability manifests in the image-fetching path of the CSV importer; refer to the GitHub Security Advisory GHSA-xgrm-8w6v-mvjg for the maintainer's technical description.

Detection Methods for CVE-2026-54166

Indicators of Compromise

Outbound HTTP requests from the Shelf application host to RFC1918 addresses, link-local ranges such as 169.254.169.254, or localhost.
CSV imports containing imageUrl values with unusual hosts, redirect services, or query strings that suggest bypass attempts.
Application logs showing large response bodies fetched during CSV import, or memory spikes correlated with import activity.
Repeated import attempts from a single account referencing distinct internal IPs or ports.

Detection Strategies

Inspect Shelf import audit logs for imageUrl values that resolve to private, loopback, or cloud metadata addresses.
Monitor egress network telemetry from the Shelf server for connections that violate expected image-CDN destinations.
Alert on redirect chains where the initial hostname differs materially from the final resolved destination.

Monitoring Recommendations

Enable request-level logging for the CSV import endpoint, capturing submitting user, source IP, and fetched URLs.
Track process-level memory usage on Shelf workers to identify buffering-driven exhaustion.
Correlate asset:import permission grants and use with anomaly detection on outbound HTTP destinations.

How to Mitigate CVE-2026-54166

Immediate Actions Required

Upgrade all Shelf deployments to version 1.20.3 or later without delay.
Audit which accounts hold the asset:import permission and revoke it from users who do not require it.
Review recent CSV import activity for suspicious imageUrl values referencing internal hosts or metadata endpoints.
Rotate any credentials that may have been reachable from the Shelf host, including cloud instance role tokens.

Patch Information

The maintainers released Shelf 1.20.3 with corrected imageUrl validation and safer HTTP fetch behavior. Details and commit references are available in the GitHub Security Advisory GHSA-xgrm-8w6v-mvjg. Operators running container images should pull the updated tag and redeploy.

Workarounds

Restrict the asset:import permission to trusted administrators until the upgrade is applied.
Place the Shelf server behind an egress proxy that blocks requests to RFC1918, loopback, and cloud metadata addresses.
Disable IMDSv1 on AWS instances and require IMDSv2 with hop-limit 1 to reduce metadata exposure.
Apply network policies that prevent the Shelf workload from reaching internal management interfaces.

bash

# Example egress restriction using iptables to block cloud metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner shelf -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shelf -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shelf -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shelf -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner shelf -d 127.0.0.0/8 -j REJECT