CVE-2026-72552 Overview
CVE-2026-72552 is a server-side request forgery (SSRF) vulnerability in Dub, an open-source link management platform. The flaw resides in the metatags edge endpoint, which fetches any caller-supplied URL without authentication or a denylist. Unauthenticated remote attackers can coerce the server into issuing HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance and data exfiltration from cloud metadata services such as the AWS Instance Metadata Service (IMDS).
Critical Impact
Unauthenticated attackers can pivot the Dub server into internal networks and retrieve sensitive cloud metadata, including temporary IAM credentials from cloud provider metadata endpoints.
Affected Products
- Dub (dubinc/dub) as of 2026-07-10
- Deployments exposing the metatags edge endpoint
- Self-hosted and edge-deployed Dub instances
Discovery Timeline
- 2026-08-11 - CVE-2026-72552 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72552
Vulnerability Analysis
The vulnerability [CWE-918] exists in Dub's metatags edge endpoint. The endpoint accepts a URL parameter from the caller and performs a server-side HTTP fetch to retrieve HTML metadata for link previews.
The endpoint does not require authentication. It also lacks a denylist for internal address ranges, loopback addresses, or cloud metadata IPs. An attacker can supply any URL, and the Dub server will issue the outbound request from its own network position.
Because the endpoint runs in an edge runtime, requests originate from within the hosting infrastructure. This bypasses perimeter controls that would normally block direct external access to internal services.
Root Cause
The root cause is missing input validation on the user-supplied URL before the server-side HTTP fetch. There is no scheme allowlist, no host resolution check against private ranges (RFC 1918, 127.0.0.0/8, 169.254.0.0/16), and no authentication requirement on the endpoint. The metatags fetcher trusts caller intent.
Attack Vector
An attacker sends an unauthenticated HTTP request to the metatags endpoint with a crafted URL parameter. The URL can target internal services such as http://127.0.0.1:8080/admin, internal Kubernetes APIs, or cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server responds with the fetched content, exposing internal responses to the attacker. No user interaction or privileges are required.
Refer to the Dub GitHub repository for source-level context on the affected endpoint. No public proof-of-concept exploit code is currently available.
Detection Methods for CVE-2026-72552
Indicators of Compromise
- Outbound HTTP requests from the Dub server process to RFC 1918 addresses, 127.0.0.1, or 169.254.169.254
- Access log entries for the metatags endpoint containing URL parameters referencing internal hostnames, private IPs, or cloud metadata endpoints
- Unusual volume of requests to the metatags edge endpoint from a single source
- DNS queries from the Dub host resolving internal-only hostnames
Detection Strategies
- Parse Dub application logs for metatags endpoint requests and flag URL parameters that resolve to non-public IP ranges
- Monitor egress traffic from Dub workloads for connections to 169.254.169.254 or internal service ports
- Alert on cloud IAM role usage from Dub compute instances that deviates from the baseline API call pattern
Monitoring Recommendations
- Ingest edge runtime access logs and cloud VPC flow logs into a centralized data lake for correlation
- Enable cloud provider audit logging for metadata service access and IAM credential usage
- Baseline normal outbound destinations for the Dub service and alert on deviations
How to Mitigate CVE-2026-72552
Immediate Actions Required
- Restrict access to the metatags endpoint at the network or reverse-proxy layer until an upstream fix is applied
- Enforce IMDSv2 with hop-limit restrictions on AWS-hosted Dub deployments to prevent SSRF-based credential theft
- Rotate any IAM credentials or secrets accessible from the Dub compute environment if exploitation is suspected
- Review access logs for the metatags endpoint dating back to 2026-07-10
Patch Information
No vendor advisory URL is listed in the NVD entry at publication. Monitor the Dub GitHub repository for security releases and commits that add URL validation to the metatags endpoint.
Workarounds
- Place the metatags endpoint behind authentication using a reverse proxy or API gateway
- Deploy an egress proxy that blocks the Dub service from reaching private IP ranges and cloud metadata addresses
- Implement a URL allowlist or denylist at the application layer to reject internal hostnames and private IPs
- Run the Dub workload in a network segment without route access to internal management interfaces
# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
