CVE-2026-75340 Overview
CVE-2026-75340 is a Server-Side Request Forgery (SSRF) vulnerability in JetLinks Community 2.11. The flaw resides in the device metadata import interface at /device/instance/{productId}/property-metadata/import. An attacker can supply a crafted URL to the import endpoint, causing the server to issue outbound requests to arbitrary destinations. This behavior enables interaction with internal services that are otherwise unreachable from external networks.
Critical Impact
Attackers can abuse the vulnerable import endpoint to probe internal networks, reach cloud metadata services, and exfiltrate data through server-initiated requests.
Affected Products
- JetLinks Community 2.11
Discovery Timeline
- 2026-08-26 - CVE-2026-75340 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75340
Vulnerability Analysis
JetLinks Community is an open-source Internet of Things (IoT) platform. The platform exposes a device metadata import endpoint that accepts a user-supplied resource location. The application fetches the referenced resource server-side without validating the destination host, scheme, or address range.
An attacker who can reach the endpoint submits a URL pointing to an internal address. The JetLinks server then performs the HTTP request on the attacker's behalf and may return response content, timing information, or error signals. This behavior maps to Server-Side Request Forgery [CWE-918].
Root Cause
The root cause is missing validation of the URL parameter passed to the import routine. The application does not enforce an allowlist of external hosts. The application does not block requests targeting loopback interfaces, link-local addresses, or private IPv4 and IPv6 ranges. As a result, the fetch operation trusts attacker-controlled input.
Attack Vector
An attacker sends a request to /device/instance/{productId}/property-metadata/import with a URL parameter that references an internal service. Typical targets include cloud instance metadata endpoints, internal administrative APIs bound to localhost, and unauthenticated services inside the platform's private network segment. Refer to the GitHub SSRF Exploit Documentation for reproduction details.
Detection Methods for CVE-2026-75340
Indicators of Compromise
- Access log entries containing requests to /device/instance/*/property-metadata/import with URL parameters pointing to private or loopback address ranges.
- Outbound HTTP requests from the JetLinks server process to 169.254.169.254, 127.0.0.1, or internal RFC1918 addresses.
- Unexpected import operations initiated by low-privilege or unauthenticated sessions.
Detection Strategies
- Inspect application and reverse proxy logs for property-metadata/import calls containing embedded URLs, IP literals, or encoded schemes such as file:// or gopher://.
- Correlate JetLinks process network telemetry with expected outbound destinations and alert on deviations.
- Deploy web application firewall rules that flag URL parameters resolving to internal IP space.
Monitoring Recommendations
- Monitor egress traffic from the JetLinks host to cloud metadata service IP addresses.
- Track request rates and response sizes on the import endpoint to identify enumeration attempts.
- Retain and centralize application logs to support retrospective SSRF investigation.
How to Mitigate CVE-2026-75340
Immediate Actions Required
- Restrict access to /device/instance/{productId}/property-metadata/import to authenticated administrative users only.
- Block the JetLinks server from reaching cloud metadata endpoints and internal management interfaces at the network layer.
- Audit recent import requests for evidence of SSRF probing against internal assets.
Patch Information
No vendor patch reference is available in the enriched CVE data at time of publication. Monitor the JetLinks Community project repository for a fixed release addressing CVE-2026-75340 and apply it once available.
Workarounds
- Enforce an allowlist of permitted hosts and schemes for the import URL parameter at a reverse proxy or gateway.
- Reject URLs that resolve to loopback, link-local, multicast, or RFC1918 address ranges before the request reaches the application.
- Disable the metadata import feature in environments where it is not required for operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
