CVE-2026-72566 Overview
CVE-2026-72566 is a server-side request forgery (SSRF) vulnerability affecting Automatisch, an open-source business automation platform. The flaw exists through commit 41f3c56 in the HTTP Request app's Custom Request action. A low-privileged authenticated user holding the manage Flow permission can coerce the backend to fetch arbitrary URLs and receive the full response body. The vulnerability maps to CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can pivot from the application server into internal networks, enumerate cloud metadata endpoints, and exfiltrate sensitive response bodies from otherwise unreachable services.
Affected Products
- Automatisch through commit 41f3c56
- Automatisch HTTP Request app — Custom Request action
- Self-hosted Automatisch deployments exposing Flow management to non-admin users
Discovery Timeline
- 2026-08-10 - CVE-2026-72566 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-72566
Vulnerability Analysis
Automatisch exposes an HTTP Request app that lets Flow authors issue outbound HTTP calls as part of workflow automation. The Custom Request action, implemented in packages/backend/src/apps/http-request/actions/custom-request/index.js, accepts a user-supplied URL and forwards the request from the server. The action performs no URL validation against internal address ranges, loopback interfaces, link-local addresses, or cloud metadata services. Any authenticated user granted the manage Flow permission can therefore invoke the action to reach resources reachable from the backend host.
The response body returned by the target service is rendered back to the Flow user. This gives the attacker read access to internal HTTP endpoints, not just blind request delivery. Attack outcomes include enumeration of internal services, retrieval of cloud instance metadata credentials, and interaction with unauthenticated management interfaces bound to localhost.
Root Cause
The root cause is missing egress URL validation in the Custom Request action. The handler treats the manage Flow permission as sufficient authorization for arbitrary outbound HTTP, conflating workflow authoring rights with network reachability decisions.
Attack Vector
Exploitation requires network access to the Automatisch web interface and a valid session with the manage Flow permission. The attacker creates or edits a Flow, adds an HTTP Request step, selects Custom Request, and points the URL at an internal target such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:<port>. Running the Flow returns the response body to the attacker. See the Custom Request action source for the vulnerable implementation.
Detection Methods for CVE-2026-72566
Indicators of Compromise
- Outbound HTTP requests from the Automatisch backend to RFC1918, loopback, or link-local addresses such as 169.254.169.254
- Flow execution logs referencing the custom-request action with unexpected internal hostnames or IP literals
- Unusual response sizes returned to Flow runs targeting cloud metadata paths like /latest/meta-data/iam/security-credentials/
Detection Strategies
- Instrument the Automatisch backend host with egress network monitoring and alert on connections to internal ranges from the application process.
- Audit the Flow database for custom-request action configurations whose URL fields resolve to private or loopback addresses.
- Correlate Automatisch audit logs of Flow edits by non-admin users against outbound HTTP telemetry to identify SSRF probing.
Monitoring Recommendations
- Log every URL submitted to the Custom Request action and retain it for review.
- Monitor identity provider events for new or elevated accounts granted the manage Flow permission.
- Alert on Automatisch backend requests to cloud metadata endpoints; these should never occur under normal operation.
How to Mitigate CVE-2026-72566
Immediate Actions Required
- Restrict the manage Flow permission to trusted administrators until a patched build is deployed.
- Place the Automatisch backend behind an egress proxy that denies traffic to RFC1918, loopback, and cloud metadata addresses.
- Rotate any credentials, tokens, or IAM role secrets reachable from the Automatisch host, assuming potential exposure.
Patch Information
No fixed release is referenced in the NVD entry at the time of publication. Track the Automatisch GitHub repository for commits addressing the Custom Request action and upgrade past commit 41f3c56 once a fix ships.
Workarounds
- Disable the HTTP Request app in Automatisch if Custom Request functionality is not required.
- Enforce an outbound allowlist at the network layer restricting the Automatisch backend to known third-party API endpoints.
- Bind cloud instance metadata service (IMDS) to IMDSv2 with hop-limit 1 to blunt metadata theft via SSRF.
# Example: block cloud metadata and internal ranges from the Automatisch container
iptables -A OUTPUT -m owner --uid-owner automatisch -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner automatisch -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner automatisch -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner automatisch -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner automatisch -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
