CVE-2026-73432: Vulnerability-Lookup SSRF Vulnerability

CVE-2026-73432 Overview

CVE-2026-73432 is a server-side request forgery (SSRF) vulnerability [CWE-918] in the Vulnerability-Lookup application. The flaw resides in the remote-instance synchronization functionality, where remote instance addresses were validated only for basic URL syntax before storage. The synchronization worker then dereferenced these addresses using requests.get() with automatic redirect handling and no network-boundary enforcement. An authenticated administrator with the admin:access permission could point a remote instance at internal, loopback, link-local, or cloud metadata HTTP(S) endpoints. The vulnerability was published to the National Vulnerability Database on 2026-08-12.

Critical Impact
A privileged attacker can leverage the Vulnerability-Lookup server to probe or interact with internal network services and cloud instance metadata endpoints that are not directly reachable from the attacker's network.

Affected Products

Vulnerability-Lookup (upstream project maintained on GitHub)
Deployments exposing the remote-instance synchronization feature
Instances where administrators hold the admin:access permission

Discovery Timeline

2026-08-12 - CVE CVE-2026-73432 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73432

Vulnerability Analysis

The vulnerability stems from insufficient validation of user-supplied URLs in the remote-instance synchronization worker. Remote instance addresses passed only a basic URL syntax check before being stored in the database. When the synchronization job later executed, the worker invoked requests.get() against these addresses directly, without validating the resolved destination.

Two behaviors compound the flaw. First, the worker did not restrict destination hostnames or IP addresses, permitting requests to loopback (127.0.0.0/8), link-local (169.254.0.0/16), private (10/8, 172.16/12, 192.168/16), and cloud metadata endpoints such as 169.254.169.254. Second, requests.get() followed HTTP redirects automatically without revalidating each hop, enabling a public URL to redirect the server to an internal destination.

Root Cause

The root cause is missing outbound URL policy enforcement in the synchronization codepath, specifically in website/scripts/sync.py and website/models/remote_instance.py. Input validation confirmed URL structure but not the security properties of the resolved network destination, satisfying the classic SSRF pattern described in [CWE-918].

Attack Vector

An authenticated administrator with the admin:access permission configures a remote instance whose address points to a sensitive internal HTTP(S) service or a public host that returns a redirect to one. When synchronization runs, the Vulnerability-Lookup server issues the request from its own network context and returns or acts on the response. Exposure depends on which services are reachable from the application server.

python

# Patch: introduce shared safe_get wrapper in sync worker
from sqlalchemy.orm import scoped_session, sessionmaker

from vulnerabilitylookup import __user_agent__
from website.lib.remote_url import UnsafeRemoteURLError, safe_get
from website.models import Bundle, Comment, KEVEntry, KEVEvidence, Sighting, User
from website.models.kev_entry import KEVExploitationStatus
from website.models.kev_evidence import KEVEvidenceType

Source: GitHub commit a3cf621

Detection Methods for CVE-2026-73432

Indicators of Compromise

Outbound HTTP(S) connections from the Vulnerability-Lookup server to RFC1918, loopback, or link-local address ranges
Requests originating from the application server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Remote-instance records referencing hostnames that resolve to internal IPs or known redirector services
Unexpected admin:access configuration changes creating or updating remote instance entries

Detection Strategies

Inspect application audit logs for creation or modification of remote instance URLs, correlating with the acting administrator account
Monitor egress traffic from the Vulnerability-Lookup host and alert on connections destined for non-public address ranges
Correlate synchronization job execution timestamps with outbound HTTP request telemetry for anomalous destinations

Monitoring Recommendations

Enable DNS query logging on the application server and flag resolutions returning private, loopback, or link-local addresses
Alert on any HTTP request whose response includes a 3xx redirect to an internal destination during sync jobs
Baseline normal remote-instance targets and generate alerts on any newly introduced hostname

How to Mitigate CVE-2026-73432

Immediate Actions Required

Upgrade Vulnerability-Lookup to a release that includes commit a3cf621c2583c45227a5b7880123ba0ffef3cc0f
Audit the admin:access role membership and remove unnecessary administrative privileges
Review all configured remote instance URLs and remove any pointing to unexpected or internal destinations

Patch Information

The upstream patch introduces a shared outbound URL policy in website/lib/remote_url.py. The policy restricts remote instances to the HTTP(S) schemes, resolves hostnames at request time, and rejects private, loopback, link-local, multicast, reserved, and unspecified addresses. Each redirect destination is manually validated before the request follows it. Details are available in the GitHub commit reference.

Workarounds

Restrict egress from the Vulnerability-Lookup host using host firewall or cloud security-group rules that deny traffic to internal ranges and metadata endpoints
Require IMDSv2 with hop-limit 1 on AWS instances to blunt metadata exposure via SSRF
Temporarily disable the remote-instance synchronization feature until the patched release is deployed

bash

# Example egress restriction: block metadata endpoint at the host firewall
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT