CVE-2026-85691: MegaParse SSRF Vulnerability

CVE-2026-85691 Overview

CVE-2026-85691 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MegaParse version 0.0.55. The flaw resides in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without validation. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly from the JSON response body. Because the endpoint requires no authentication, any network-adjacent attacker can pivot into internal infrastructure through the MegaParse service. The vulnerability is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can coerce MegaParse to fetch arbitrary internal URLs, exposing cloud instance metadata, internal APIs, and other services reachable from the MegaParse host.

Affected Products

MegaParse 0.0.55 (The Vibe Company)
Deployments exposing the POST /v1/url API endpoint
Containerized or cloud-hosted MegaParse instances with access to internal metadata services

Discovery Timeline

2026-09-04 - CVE-2026-85691 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-85691

Vulnerability Analysis

MegaParse is a document parsing library that exposes an HTTP API for ingesting content from remote URLs. The vulnerable route accepts a user-controlled URL parameter and issues a server-side HTTP request to retrieve the target resource for parsing. The response body is then returned in the JSON output, giving the caller direct visibility into whatever the server fetched.

Because the endpoint enforces no authentication and no allowlist on target hosts, an attacker can direct MegaParse to internal-only addresses. This includes loopback services, RFC1918 network ranges, and cloud provider metadata endpoints such as http://169.254.169.254/. On managed cloud instances, that metadata service can expose temporary IAM credentials, user-data scripts, and instance identity documents.

Root Cause

The root cause is missing input validation and URL filtering in the /v1/url handler defined in libs/megaparse/src/megaparse/api/app.py. The application trusts the supplied URL and passes it directly to a server-side HTTP client. No network destination checks, DNS pinning, or scheme restrictions are applied before the outbound request is issued.

Attack Vector

Exploitation requires only network access to the MegaParse API. An attacker submits a crafted POST request with the target internal URL in the request body. MegaParse issues the outbound request from its own network position and returns the fetched content in the response. See the VulnCheck Advisory and GitHub Issue #259 for reproduction details and the vulnerable app.py source.

Detection Methods for CVE-2026-85691

Indicators of Compromise

Unexpected POST requests to /v1/url targeting internal IPs, 127.0.0.1, or 169.254.169.254
MegaParse process initiating outbound connections to RFC1918 subnets or cloud metadata endpoints
Anomalous authentication events using IAM credentials that match the MegaParse host role
Web access logs showing external clients supplying file://, gopher://, or non-HTTPS schemes to /v1/url

Detection Strategies

Inspect reverse proxy and application logs for POST requests to /v1/url where the URL parameter resolves to private, link-local, or loopback address space
Correlate MegaParse container network flows with metadata service IP ranges specific to AWS, Azure, and GCP
Alert on JSON responses from /v1/url containing markers of metadata documents such as iam/security-credentials or instance-identity

Monitoring Recommendations

Enable egress flow logging on hosts running MegaParse and baseline expected destinations
Instrument the reverse proxy in front of MegaParse to capture full request bodies for the /v1/url route
Monitor cloud audit logs for credential use originating from the MegaParse workload identity

How to Mitigate CVE-2026-85691

Immediate Actions Required

Restrict network access to the MegaParse API so it is not reachable from untrusted networks or the public internet
Place authentication in front of the /v1/url endpoint using a reverse proxy or API gateway
Block outbound traffic from the MegaParse host to cloud metadata IP ranges and internal management networks
Rotate any IAM credentials or secrets that were reachable from the MegaParse host if exploitation is suspected

Patch Information

No vendor-supplied patch is referenced in the advisory at the time of publication. Track the MegaParse GitHub repository and Issue #259 for a fixed release. Until a fix is available, treat MegaParse 0.0.55 as vulnerable and apply compensating controls.

Workarounds

Enforce IMDSv2 on AWS instances to require session-token requests and defeat basic SSRF against the metadata service
Deploy MegaParse behind an egress proxy that allowlists only required external destinations
Front the API with an authenticating reverse proxy and drop requests to /v1/url from untrusted sources
Run MegaParse in an isolated network namespace with no route to internal services or metadata endpoints

bash

# Example iptables egress restriction blocking cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP