CVE-2026-71172 Overview
CVE-2026-71172 is a Server-Side Request Forgery (SSRF) vulnerability affecting Dell Cloud Disaster Recovery versions 20.2 and prior. The flaw allows a low-privileged, remote attacker to coerce the application into issuing unintended requests to internal or external resources. Successful exploitation results in unauthorized access to information reachable from the server, without impact to integrity or availability. Dell has published advisory DSA-2026-353 addressing this issue. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated remote attacker can abuse Cloud Disaster Recovery to issue server-side requests, potentially exposing internal services or metadata endpoints reachable from the appliance.
Affected Products
- Dell Cloud Disaster Recovery version 20.2
- Dell Cloud Disaster Recovery versions prior to 20.2
Discovery Timeline
- 2026-08-26 - CVE-2026-71172 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-71172
Vulnerability Analysis
Dell Cloud Disaster Recovery accepts user-supplied input that influences the destination of server-initiated HTTP requests. The application does not adequately validate or restrict these destinations. An authenticated attacker with low privileges can supply crafted URLs that cause the backend service to fetch arbitrary resources on behalf of the attacker.
Because the request originates from the Cloud Disaster Recovery host, it may reach internal-only endpoints, cloud provider metadata services, or other network segments not directly accessible from the attacker's location. The vulnerability affects only confidentiality; integrity and availability are not impacted per the vendor's scoring.
Root Cause
The root cause is insufficient validation of user-controlled input used to construct outbound HTTP requests [CWE-918]. Without an allowlist of permitted hosts, protocol restrictions, or network egress controls, the server treats attacker-supplied URLs as trusted destinations. Dell's advisory does not detail the specific parameter or endpoint affected.
Attack Vector
The attacker must authenticate with low-privileged credentials and then submit a request to the vulnerable feature. Because Cloud Disaster Recovery is a network-facing appliance often deployed with connectivity to internal management planes and cloud provider APIs, the practical blast radius includes internal HTTP services, IMDS endpoints in cloud deployments, and lateral reconnaissance targets.
No public proof-of-concept exploit code is available. Refer to the Dell Security Advisory DSA-2026-353 for vendor-supplied technical details.
Detection Methods for CVE-2026-71172
Indicators of Compromise
- Outbound HTTP or HTTPS connections from the Cloud Disaster Recovery host to unexpected internal IP ranges or cloud metadata endpoints such as 169.254.169.254.
- Application logs showing user-supplied URL parameters targeting loopback, link-local, or RFC1918 addresses.
- Authentication events from low-privileged accounts followed by anomalous outbound requests originating from the appliance.
Detection Strategies
- Inspect Cloud Disaster Recovery application logs for URL-shaped parameters resolving to internal hosts or non-standard ports.
- Correlate authenticated user activity with outbound request patterns using network telemetry from the appliance.
- Baseline normal egress destinations for the Cloud Disaster Recovery host and alert on deviations.
Monitoring Recommendations
- Enable verbose logging on the Cloud Disaster Recovery management interface and forward logs to a centralized SIEM.
- Monitor egress firewall logs for connections from the appliance to unexpected internal segments.
- Alert on any request from the appliance to cloud instance metadata service endpoints.
How to Mitigate CVE-2026-71172
Immediate Actions Required
- Upgrade Dell Cloud Disaster Recovery to the fixed version identified in DSA-2026-353.
- Audit user accounts on Cloud Disaster Recovery and remove or disable unnecessary low-privileged access.
- Restrict network egress from the appliance to only the destinations required for disaster recovery operations.
Patch Information
Dell has released a security update addressing CVE-2026-71172. Customers should consult the Dell Security Advisory DSA-2026-353 for the specific fixed version and upgrade procedures.
Workarounds
- Apply strict egress filtering on the Cloud Disaster Recovery host to block requests to internal management ranges and cloud metadata services.
- Enforce network segmentation so the appliance cannot reach sensitive internal HTTP services.
- Where cloud-hosted, configure Instance Metadata Service v2 (IMDSv2) with hop limits to reduce SSRF exposure to metadata credentials.
# Example egress restriction blocking IMDS access from the appliance
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
