CVE-2026-82667: yaojingang GEOFlow SSRF Vulnerability

CVE-2026-82667 Overview

CVE-2026-82667 is a server-side request forgery (SSRF) vulnerability in yaojingang GEOFlow through version 2.1.0. The flaw resides in the DistributionController::isValidHttpEndpoint function within app/Services/GeoFlow/GenericHttpEndpointResolver.php. Attackers can manipulate the endpoint_url argument to make the server issue arbitrary outbound HTTP requests. The issue is exploitable remotely by an authenticated user with elevated privileges, and the exploit has been publicly disclosed. GEOFlow maintainers released version 2.1.1 with patch commit 67abfd864a15d169a78429f3290c91cb3b93e849 to address the flaw. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
A remote attacker with sufficient privileges can coerce the GEOFlow backend into making arbitrary HTTP requests against internal services, cloud metadata endpoints, or private networks reachable from the application server.

Affected Products

yaojingang GEOFlow versions up to and including 2.1.0
Vulnerable component: app/Services/GeoFlow/GenericHttpEndpointResolver.php
Vulnerable function: DistributionController::isValidHttpEndpoint

Discovery Timeline

2026-08-31 - CVE-2026-82667 published to NVD
2026-08-31 - Last updated in NVD database
Patch commit - 67abfd864a15d169a78429f3290c91cb3b93e849 merged via Pull Request #61, tracking Issue #60
Fixed release - GEOFlow v2.1.1

Technical Details for CVE-2026-82667

Vulnerability Analysis

GEOFlow accepts a user-supplied endpoint_url parameter that is passed to the resolver responsible for validating HTTP endpoints prior to outbound requests. The isValidHttpEndpoint routine in GenericHttpEndpointResolver.php did not adequately restrict destinations, allowing the backend to reach private-network addresses, loopback, or cloud metadata services. Because the request originates from the application server, downstream services see it as trusted internal traffic. The EPSS score is 0.342% at percentile 26.988, indicating limited but non-zero probability of exploitation activity in the short term. Public disclosure of the exploit lowers the barrier for opportunistic attackers scanning for exposed GEOFlow deployments.

Root Cause

The root cause is inadequate endpoint validation prior to performing HTTP fetches. The pre-patch configuration relied on an URL_IMPORT_ALLOW_MIXED_DNS toggle and a GEOFLOW_NO_PROXY list to constrain destinations, but there was no strict deny-by-default policy for private-network targets. Any URL that satisfied basic parsing checks could be dispatched by the resolver.

Attack Vector

Exploitation requires network access to the GEOFlow instance and an account with high privileges to invoke the distribution endpoint. The attacker submits a crafted endpoint_url value pointing to an internal service, cloud metadata IP (for example 169.254.169.254), or an internal HTTP API. The server then performs the request, and depending on response handling, may return content to the attacker or trigger internal side effects such as configuration changes.

text

// Security patch (.env.example) from commit 67abfd864a15d169a78429f3290c91cb3b93e849
// Removed permissive proxy/DNS toggles and introduced strict outbound gating:
-# URL 智能采集 SSRF 防护默认严格；仅在明确受控的透明代理/Docker/VPN 混合 DNS 环境中开启。
-URL_IMPORT_ALLOW_MIXED_DNS=false
-GEOFLOW_NO_PROXY=localhost,127.0.0.1,::1,postgres,redis,host.docker.internal
+# 私网出站仅允许精确 host:port（逗号分隔）；留空时全部拒绝，不支持通配符或路径。
+GEOFLOW_OUTBOUND_PRIVATE_TARGETS=
+GEOFLOW_OUTBOUND_JSON_MAX_BYTES=4194304
+GEOFLOW_OUTBOUND_AI_MAX_BYTES=8388608
+GEOFLOW_OUTBOUND_IMPORT_MAX_BYTES=5242880
+GEOFLOW_OUTBOUND_METADATA_MAX_BYTES=1048576
+# 安全出站网关会绕过系统/进程 HTTP 代理并固定已校验 IP，避免代理改写目标。

Source: GitHub commit 67abfd8. The patch replaces the permissive proxy model with an explicit allowlist (GEOFLOW_OUTBOUND_PRIVATE_TARGETS), enforces response size caps, and introduces a secure outbound gateway that pins validated IPs to prevent DNS rebinding and proxy rewriting.

Detection Methods for CVE-2026-82667

Indicators of Compromise

Outbound HTTP requests from the GEOFlow application host to RFC1918 addresses, 127.0.0.1, ::1, or 169.254.169.254.
Application logs referencing DistributionController::isValidHttpEndpoint accepting non-public hostnames.
Anomalous parameter values for endpoint_url in distribution or import API requests, especially non-HTTPS schemes or IP literals.

Detection Strategies

Instrument the outbound HTTP client used by GEOFlow to log resolved IPs alongside requested hostnames, then alert on divergence indicative of DNS rebinding.
Deploy egress network monitoring that flags application-tier traffic destined for internal subnets or cloud metadata IPs.
Correlate authenticated administrative API calls with unusual server-initiated HTTP fetches occurring within the same session.

Monitoring Recommendations

Enable web server access logging for all endpoints that accept URL parameters and retain logs for post-incident analysis.
Monitor cloud provider audit trails for metadata-service access originating from the GEOFlow instance role.
Track version banners across GEOFlow deployments to identify hosts still running 2.1.0 or earlier.

How to Mitigate CVE-2026-82667

Immediate Actions Required

Upgrade GEOFlow to version 2.1.1 or later, which contains patch commit 67abfd864a15d169a78429f3290c91cb3b93e849.
Audit accounts with high privileges on GEOFlow and rotate credentials suspected of exposure.
Review historical logs for suspicious endpoint_url values targeting internal or metadata addresses.

Patch Information

The fix is delivered in GEOFlow v2.1.1 via Pull Request #61, which resolves Issue #60. The patch removes permissive proxy toggles, introduces GEOFLOW_OUTBOUND_PRIVATE_TARGETS as an explicit allowlist, adds byte-size caps for outbound response payloads, and routes outbound calls through a secure gateway that pins validated IPs. Additional advisory tracking is available at VulDB CVE-2026-82667.

Workarounds

If immediate upgrade is not possible, block egress from the GEOFlow application host to private-network ranges and cloud metadata endpoints at the network layer.
Restrict administrative and distribution endpoints to trusted operator networks using a web application firewall or reverse proxy allowlist.
Reduce the number of accounts holding privileges required to invoke the vulnerable distribution endpoint.

bash

# Example post-upgrade hardening in .env / .env.prod
GEOFLOW_OUTBOUND_PRIVATE_TARGETS=
GEOFLOW_OUTBOUND_JSON_MAX_BYTES=4194304
GEOFLOW_OUTBOUND_AI_MAX_BYTES=8388608
GEOFLOW_OUTBOUND_IMPORT_MAX_BYTES=5242880
GEOFLOW_OUTBOUND_METADATA_MAX_BYTES=1048576
GEOFLOW_LEGACY_IMAGE_PATH_INPUT=false