CVE-2026-87821: Lara Dashboard SSRF Vulnerability

CVE-2026-87821 Overview

CVE-2026-87821 is a Server-Side Request Forgery (SSRF) vulnerability in Lara Dashboard versions 0.9.2 through 1.3.1. The flaw resides in the POST /api/admin/builder/markdown/fetch endpoint, which accepts a user-supplied URL and returns the response body without host validation or redirect restrictions. Any authenticated user can coerce the server to fetch arbitrary internal or external URLs. Attackers can reach internal HTTP services and cloud provider metadata endpoints, including AWS Instance Metadata Service (IMDS) IAM credentials. The vulnerability is classified as [CWE-918] Server-Side Request Forgery.

Critical Impact
Authenticated attackers can retrieve cloud IAM credentials and reach internal-only services, enabling lateral movement and potential full cloud account compromise.

Affected Products

Lara Dashboard 0.9.2 through 1.3.1
app/Services/Builder/MarkdownFetchService.php component
app/Http/Controllers/Api/Builder/MarkdownController.php component

Discovery Timeline

2026-09-09 - CVE-2026-87821 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87821

Vulnerability Analysis

The Lara Dashboard exposes an admin API endpoint that fetches remote Markdown content for its page builder. The endpoint accepts a URL parameter and delegates HTTP retrieval to MarkdownFetchService. In versions up to 1.3.1, the service issues the outbound request without validating the target host, scheme, or resolved IP address. Redirects are also followed without restriction, which allows bypass of naive filters via 302 chains.

Because the endpoint requires only a low-privilege authenticated session, any user with dashboard access can trigger requests originating from the application server. In cloud deployments the server can reach link-local metadata addresses such as 169.254.169.254, exposing IAM role credentials. The full response body is returned to the caller, converting the SSRF into a direct data-exfiltration primitive.

Root Cause

The root cause is missing URL validation in the Markdown fetch pipeline. MarkdownFetchService in v1.3.1 accepts arbitrary schemes and hosts, does not resolve and blocklist private or link-local address ranges, and does not cap redirect behavior. The fix introduces a new app/Support/Security/SafeUrlValidator.php helper that enforces host and scheme allowlists before any outbound request.

Attack Vector

Exploitation requires network access to the dashboard and a valid authenticated session. An attacker sends a POST request to /api/admin/builder/markdown/fetch with a URL pointing to an internal target. Common targets include cloud metadata services, internal admin APIs on 127.0.0.1, and unauthenticated services on the internal network. The response body is returned in the JSON response, allowing the attacker to read credentials, tokens, and internal service data.

php

// Security patch: MarkdownController now uses typed FormRequests
// that invoke SafeUrlValidator before the fetch service runs.
 namespace App\Http\Controllers\Api\Builder;

 use App\Http\Controllers\Controller;
+use App\Http\Requests\Builder\MarkdownConvertRequest;
+use App\Http\Requests\Builder\MarkdownConvertUrlRequest;
+use App\Http\Requests\Builder\MarkdownFetchRequest;
 use App\Services\Builder\MarkdownFetchService;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Http\Request;

 class MarkdownController extends Controller
 {
// Source: https://github.com/laradashboard/laradashboard/commit/738cc1a219ce459323ef1d09c3789075f1b8d2f2

Detection Methods for CVE-2026-87821

Indicators of Compromise

Application logs showing POST /api/admin/builder/markdown/fetch requests with URLs targeting private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.169.254).
Outbound HTTP requests from the Lara Dashboard server process to cloud metadata endpoints not associated with normal application behavior.
Unusual authenticated sessions issuing repeated fetch requests to varied hostnames or IP literals within short timeframes.

Detection Strategies

Deploy web application firewall rules that inspect the url parameter of the Markdown fetch endpoint and block requests targeting RFC1918, loopback, and link-local addresses.
Correlate authenticated dashboard sessions with outbound egress from the application host to detect SSRF pivoting to internal services.
Alert on any request from application servers to 169.254.169.254, metadata.google.internal, or Azure IMDS endpoints that does not originate from expected system components.

Monitoring Recommendations

Enable verbose logging of the MarkdownFetchService including target URL, response code, and response size.
Monitor IAM credential usage for anomalous source IPs, geolocations, or API call patterns that deviate from the instance role's baseline.
Track HTTP redirect chains from the application server and flag redirects that terminate on internal IP space.

How to Mitigate CVE-2026-87821

Immediate Actions Required

Upgrade Lara Dashboard to version 1.3.2 or later, which introduces SafeUrlValidator and typed request validation.
Rotate any cloud IAM credentials, session tokens, and secrets accessible to the application host if exploitation is suspected.
Enforce IMDSv2 with hop-limit 1 on AWS EC2 instances hosting Lara Dashboard to block SSRF-based credential theft.

Patch Information

The vendor released Lara Dashboard v1.3.2 containing the fix. The remediation is described in GitHub Security Advisory GHSA-4xqv-4c27-6c4j and implemented in commit 738cc1a2. The patch adds MarkdownFetchRequest and the new SafeUrlValidator helper to validate scheme, host, and resolved IP before any outbound fetch.

Workarounds

Restrict access to /api/admin/builder/markdown/fetch at the reverse proxy or WAF layer until the upgrade is applied.
Deploy the application behind an egress proxy that denies traffic to RFC1918, loopback, and cloud metadata address ranges.
Revoke or minimize the IAM role attached to the Lara Dashboard host to reduce blast radius of any credential theft.

bash

# Example nginx egress restriction on the Markdown fetch endpoint
location = /api/admin/builder/markdown/fetch {
    # Require MFA-backed session cookie in front of the endpoint
    auth_request /_internal/verify_admin;

    # Rate limit to slow SSRF probing
    limit_req zone=markdown_fetch burst=5 nodelay;

    proxy_pass http://laradashboard_upstream;
}

# AWS: enforce IMDSv2 with hop limit 1
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled