CVE-2026-86119: Webstudio SSRF Vulnerability

CVE-2026-86119 Overview

CVE-2026-86119 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability affecting Webstudio versions through 0.296.0. The flaw resides in three proxy routes: /cgi/image, /cgi/video, and /cgi/asset. When the RESIZE_ORIGIN environment variable is unset, these endpoints accept arbitrary URLs and issue server-side requests without validation. Attackers can abuse this behavior to reach cloud instance metadata services, query internal-only applications, and map the network surrounding the affected host. The vulnerability is tracked under CWE-918.

Critical Impact
Unauthenticated attackers can exfiltrate cloud credentials from instance metadata endpoints and pivot into internal services reachable from the Webstudio host.

Affected Products

Webstudio versions through 0.296.0
Deployments where the RESIZE_ORIGIN environment variable is unset
Self-hosted Webstudio builder instances exposing /cgi/image, /cgi/video, or /cgi/asset

Discovery Timeline

2026-09-05 - CVE-2026-86119 published to NVD
2026-09-05 - Last updated in NVD database

Technical Details for CVE-2026-86119

Vulnerability Analysis

Webstudio exposes three proxy handlers used for transforming or fetching remote media: cgi.image.$.ts, cgi.video.$.ts, and cgi.asset.$.ts. Each handler accepts a user-supplied URL and issues a server-side HTTP request to retrieve the resource. When RESIZE_ORIGIN is defined, requests are constrained to that origin. When the variable is unset, the handlers fall back to processing any URL supplied by the caller.

Because the routes do not require authentication, any remote client can reach them over the network. The server performs the outbound request from its own network context. This context typically includes access to link-local metadata addresses such as 169.254.169.254 on AWS, GCP, and Azure, along with internal RFC 1918 ranges and container orchestration APIs.

Successful exploitation returns response bodies to the attacker, enabling retrieval of temporary IAM credentials, Kubernetes service account tokens, and internal service data. See the VulnCheck SSRF Advisory for Webstudio for additional context.

Root Cause

The root cause is missing origin validation in the CGI proxy routes combined with an insecure default when RESIZE_ORIGIN is not set. The code defaults to permissive URL fetching rather than failing closed. Review the affected handlers in the GitHub CGI Image Route Code, GitHub CGI Video Route Code, and GitHub CGI Asset Route Code.

Attack Vector

An attacker sends an HTTP request to one of the three proxy routes with a target URL parameter. The Webstudio backend fetches the URL and returns the content. Attackers point the parameter at cloud metadata endpoints, internal admin dashboards, or unauthenticated internal APIs. No credentials or user interaction are required. Refer to GitHub Issue #5816 for the coordinated report.

No verified public exploit code is available. The vulnerability mechanism is described in prose above; consult the vendor references for technical details.

Detection Methods for CVE-2026-86119

Indicators of Compromise

Outbound requests from the Webstudio host to 169.254.169.254, metadata.google.internal, or metadata.azure.com
Access log entries on /cgi/image, /cgi/video, or /cgi/asset containing URL parameters pointing to RFC 1918 addresses or localhost
Unexpected DNS lookups originating from the Webstudio process for internal hostnames
Response sizes on CGI proxy routes that deviate from typical media payload patterns

Detection Strategies

Alert on HTTP requests to /cgi/(image|video|asset) where the target URL parameter resolves to private, loopback, or link-local addresses
Monitor egress traffic from Webstudio infrastructure for connections to cloud metadata IPs
Correlate proxy route access with subsequent use of newly issued IAM credentials from the affected instance

Monitoring Recommendations

Ingest Webstudio application logs and cloud VPC flow logs into a centralized analytics platform for correlation
Enable AWS GuardDuty UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration findings or equivalent GCP and Azure detections
Baseline outbound network destinations from the Webstudio host and alert on deviations

How to Mitigate CVE-2026-86119

Immediate Actions Required

Set the RESIZE_ORIGIN environment variable to a trusted origin on every Webstudio deployment before restarting the service
Restrict inbound network access to /cgi/image, /cgi/video, and /cgi/asset to trusted clients using a reverse proxy or WAF rule
Enforce IMDSv2 with hop limit of 1 on AWS instances and disable legacy metadata endpoints on other cloud providers
Rotate any IAM credentials, service account tokens, or secrets exposed on the affected instance

Patch Information

No fixed version is identified in the enriched CVE data. Track the GitHub Webstudio Repository and GitHub Issue #5816 for patch releases beyond version 0.296.0.

Workarounds

Configure RESIZE_ORIGIN to a specific allowlisted origin so the proxy handlers reject arbitrary URLs
Deploy an egress firewall that blocks outbound requests from the Webstudio host to 169.254.0.0/16, 127.0.0.0/8, and RFC 1918 ranges not required for operation
Place Webstudio behind an authenticating reverse proxy to eliminate unauthenticated access to CGI routes

bash

# Configuration example: enforce RESIZE_ORIGIN in the runtime environment
export RESIZE_ORIGIN="https://assets.example.com"

# Example nginx rule to block SSRF targets at the proxy layer
# location ~ ^/cgi/(image|video|asset) {
#     if ($arg_url ~* "(169\.254|127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)") {
#         return 403;
#     }
#     proxy_pass http://webstudio_upstream;
# }