CVE-2026-72560: Label Studio SSRF Vulnerability

CVE-2026-72560 Overview

CVE-2026-72560 is a server-side request forgery (SSRF) vulnerability in HumanSignal Label Studio through version 1.24.0.dev0. The flaw exists because the SSRF_PROTECTION_ENABLED configuration flag is set to false by default. The import-from-URL endpoint fetches any URL supplied by the caller, including internal loopback addresses, without validation. An authenticated user can abuse this behavior to reach internal services, cloud metadata endpoints, and other resources not intended for external access.

Critical Impact
Authenticated attackers can pivot from Label Studio into internal networks and query cloud metadata services (for example, AWS Instance Metadata Service) to retrieve credentials and sensitive configuration data.

Affected Products

HumanSignal Label Studio versions through 1.24.0.dev0
Default installations where SSRF_PROTECTION_ENABLED is left at its default value of false
Deployments exposing the import-from-URL endpoint to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-72560 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72560

Vulnerability Analysis

Label Studio is an open-source data labeling platform used to prepare training data for machine learning models. The application exposes an import endpoint that accepts a URL parameter and fetches the referenced resource on behalf of the user. When SSRF_PROTECTION_ENABLED is false, the fetch logic does not filter destination hosts. Requests originate from the Label Studio server, which typically has network access to internal management interfaces and cloud provider metadata endpoints.

The issue is classified under CWE-918: Server-Side Request Forgery. Exploitation requires an authenticated account, but Label Studio deployments frequently allow self-registration or provision low-privilege annotator accounts to many users. Any such account is sufficient to invoke the vulnerable endpoint.

Root Cause

The root cause is an insecure default configuration. The SSRF_PROTECTION_ENABLED setting controls whether Label Studio validates outbound fetch destinations against a blocklist of internal address ranges. Because the flag defaults to false, the import-from-URL handler will resolve and connect to any hostname the caller supplies, including 127.0.0.1, 169.254.169.254, RFC1918 addresses, and IPv6 link-local addresses.

Attack Vector

An authenticated attacker submits a crafted URL to the import-from-URL endpoint. The Label Studio server issues an HTTP request to that URL from within its own network context. The attacker can target:

Cloud metadata services such as http://169.254.169.254/latest/meta-data/ to enumerate IAM role credentials
Internal admin interfaces bound to loopback, such as databases, Redis, or orchestration APIs
Internal-only microservices reachable through the container or VPC network

Response content or timing differences can leak the presence and state of internal services back to the attacker. Because no verified public exploit is currently published, defenders should treat the technique as standard SSRF pivoting against fetch endpoints. See the HumanSignal Label Studio repository for source-level context.

Detection Methods for CVE-2026-72560

Indicators of Compromise

Outbound HTTP requests from the Label Studio process to 169.254.169.254, 127.0.0.1, localhost, or private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Import task records referencing URLs pointing to loopback, link-local, or internal-only hostnames
Unexpected access patterns to cloud instance metadata endpoints originating from the Label Studio workload identity

Detection Strategies

Inspect Label Studio application logs for import-from-URL calls whose target host resolves to a private, loopback, or metadata IP
Correlate egress traffic from the Label Studio container or host against destination IP allowlists at the network layer
Alert on any authenticated Label Studio API call that includes a URL parameter targeting non-public infrastructure

Monitoring Recommendations

Enable verbose logging on the import subsystem and forward events to a centralized logging platform
Configure egress firewall telemetry to record all outbound connections initiated by the Label Studio service account
Monitor cloud audit logs (for example, AWS CloudTrail) for use of IAM role credentials issued to the Label Studio instance from unusual source IPs

How to Mitigate CVE-2026-72560

Immediate Actions Required

Set SSRF_PROTECTION_ENABLED=true in the Label Studio environment configuration and restart the service
Restrict outbound network access from the Label Studio host to only the domains required for legitimate import workflows
On cloud deployments, enforce IMDSv2 with hop-limit 1 to block SSRF-based metadata credential theft
Audit existing Label Studio user accounts and disable self-registration if not required

Patch Information

At the time of publication, no fixed release version is documented in the NVD entry. Track the HumanSignal Label Studio repository for updated releases that change the default value of SSRF_PROTECTION_ENABLED or remove the insecure fetch path.

Workarounds

Place Label Studio behind an egress proxy that blocks requests to loopback, link-local, and RFC1918 destinations
Deploy Label Studio in a dedicated network segment with no route to internal management interfaces or metadata endpoints
Remove or disable the import-from-URL feature at the reverse proxy layer if the workflow is not used

bash

# Configuration example: enable SSRF protection and enforce IMDSv2
export SSRF_PROTECTION_ENABLED=true

# AWS: require IMDSv2 and limit hop count to prevent container SSRF
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled