CVE-2026-82285: bisheng SSRF Vulnerability

CVE-2026-82285 Overview

CVE-2026-82285 is a Server-Side Request Forgery (SSRF) vulnerability affecting Bisheng through version 2.6.0-fix2. The flaw resides in the POST /api/v1/workflow/report/callback endpoint, which lacks authentication and enforces no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to force the server to issue outbound requests. Attackers use this primitive to enumerate internal network services and query cloud instance metadata endpoints. Captured responses are then retrieved from object storage using caller-supplied object names, giving adversaries a read channel for the SSRF results. The issue is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can reach internal services and cloud metadata endpoints, then read the responses from object storage, enabling reconnaissance and potential credential theft.

Affected Products

Bisheng (dataelement/bisheng) through 2.6.0-fix2
Deployments exposing the /api/v1/workflow/report/callback endpoint
Bisheng instances co-located with cloud metadata services (AWS, GCP, Azure)

Discovery Timeline

2026-08-28 - CVE-2026-82285 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82285

Vulnerability Analysis

Bisheng exposes a workflow callback endpoint intended to receive report delivery notifications. The handler in src/backend/bisheng/api/v1/workflow.py accepts a caller-controlled URL parameter and issues an HTTP request from the server context. The endpoint does not require authentication, so any network-reachable client can invoke it. The handler stores the response body in object storage under a caller-supplied object name. Attackers subsequently fetch that object to read the SSRF response. This two-stage design converts a blind SSRF into a fully readable SSRF, which is significantly more useful for attackers targeting cloud metadata services.

Root Cause

The root cause is missing input validation combined with missing authentication. The callback handler performs no URL scheme allowlisting, so http://, file://, gopher://, and other schemes supported by the underlying HTTP client may be accepted. It performs no host filtering, so requests to 169.254.169.254, 127.0.0.1, or internal RFC1918 ranges are permitted. Because the endpoint is anonymous, no rate limiting or attribution ties requests to a specific user.

Attack Vector

An unauthenticated attacker sends a POST request to /api/v1/workflow/report/callback with a target URL and an object name. Bisheng fetches the URL server-side and writes the response into object storage under the supplied name. The attacker then retrieves the stored object to read internal responses. Practical targets include AWS IMDS at http://169.254.169.254/latest/meta-data/iam/security-credentials/, GCP metadata at http://metadata.google.internal/, internal admin panels, and Kubernetes API endpoints.

A verified proof-of-concept is not publicly available. Refer to the VulnCheck Security Advisory and the GitHub Workflow API Source Code for the vulnerable handler.

Detection Methods for CVE-2026-82285

Indicators of Compromise

Unauthenticated POST requests to /api/v1/workflow/report/callback in Bisheng access logs
Outbound server requests to 169.254.169.254, metadata.google.internal, or internal RFC1918 ranges originating from the Bisheng backend
Unexpected objects appearing in the Bisheng object storage bucket with attacker-controlled names
Anonymous read requests to object storage retrieving those newly created objects

Detection Strategies

Alert on any request to /api/v1/workflow/report/callback that lacks a session or API token header
Correlate inbound callback requests with subsequent egress traffic to metadata IP ranges or private CIDRs
Baseline normal callback URL destinations and flag deviations to non-approved hosts

Monitoring Recommendations

Enable HTTP request body logging for the workflow API path and forward to a central log store
Monitor cloud metadata service access using VPC flow logs and cloud-native audit trails
Track object storage PutObject and GetObject operations on the Bisheng bucket for anomalous names and access patterns

How to Mitigate CVE-2026-82285

Immediate Actions Required

Restrict network access to the Bisheng /api/v1/workflow/report/callback endpoint using a reverse proxy or WAF rule until a patched release is deployed
Block egress from the Bisheng backend to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and to internal management CIDRs
Rotate any IAM credentials, service account tokens, or API keys exposed to the Bisheng workload if exploitation is suspected
Audit the Bisheng object storage bucket for unexpected objects and review recent GetObject activity

Patch Information

At the time of publication, no fixed release beyond 2.6.0-fix2 is referenced in the advisory. Track GitHub Issue #2190 and the Bisheng project repository for a security release. Apply the vendor patch as soon as it is available and verify that the callback endpoint requires authentication and enforces URL validation.

Workarounds

Place Bisheng behind an authenticating reverse proxy that requires a valid session for all /api/v1/workflow/* paths
Deploy a WAF rule that rejects callback requests where the URL parameter resolves to private, loopback, or link-local addresses
Use IMDSv2 with hop-limit 1 on AWS to reduce credential theft impact from SSRF against 169.254.169.254
Apply Kubernetes NetworkPolicies or cloud security groups to deny egress from the Bisheng pod to metadata and internal admin networks

bash

# Example egress restriction using iptables on the Bisheng host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 22 -j DROP