CVE-2026-90769: Open Notebook SSRF Vulnerability

CVE-2026-90769 Overview

CVE-2026-90769 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Open Notebook versions before 1.11.0. The POST /api/sources endpoint fails to validate the URL parameter, allowing authenticated users to coerce the application server into issuing arbitrary HTTP requests. Attackers can target cloud instance metadata endpoints, internal network services, and localhost-bound applications that the server can reach.

Critical Impact
Authenticated attackers can read cloud metadata credentials, pivot to internal-only services, and enumerate the application server's private network by abusing the source ingestion endpoint.

Affected Products

Open Notebook versions prior to 1.11.0
The vulnerable component is the api/routers/sources.py link-source handler
Deployments exposing the /api/sources REST endpoint to authenticated users

Discovery Timeline

2026-09-13 - CVE-2026-90769 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90769

Vulnerability Analysis

Open Notebook accepts a user-supplied URL when a caller creates a source through POST /api/sources. The application server then performs a direct HTTP request against that URL to ingest the linked content. Because the handler does not validate the target, authenticated users can point the server at any address it can reach on the network.

This behavior turns the application server into a request proxy. Attackers can retrieve cloud provider metadata such as AWS EC2 IMDS at http://169.254.169.254/, contact loopback services listening on 127.0.0.1, and enumerate internal subnets that are otherwise isolated from the public network.

The VulnCheck advisory tracks this issue as a link-source SSRF, and the fix ships in Open Notebook 1.11.0.

Root Cause

The root cause is missing URL validation before outbound HTTP requests in the sources router. The handler treats attacker-controlled input as trusted and does not restrict schemes, hostnames, resolved IP ranges, or redirects. Private, link-local, and loopback destinations are all reachable through the same code path used for public URLs.

Attack Vector

Exploitation requires authenticated access and standard network reachability to the Open Notebook API. An attacker submits a JSON body to /api/sources containing a URL that resolves to an internal target. The server issues the request and returns fetched content or observable side effects to the attacker, exposing metadata, tokens, or internal service responses.

python

# Security patch from Open Notebook 1.11.0 - api/routers/sources.py
 from surreal_commands import execute_command_sync, submit_command
 
 from api.command_service import CommandService
+from api.credentials_service import validate_url
 from api.models import (
     AssetModel,
     CreateSourceInsightRequest,

Source: GitHub Commit 9045ea5. The patch introduces a validate_url helper imported from api.credentials_service and applies it to URL inputs in the source ingestion path.

Detection Methods for CVE-2026-90769

Indicators of Compromise

Outbound HTTP requests from the Open Notebook server process to link-local addresses such as 169.254.169.254 or private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Application logs showing POST /api/sources requests whose URL parameter references loopback, internal DNS names, or non-HTTP schemes.
Unexpected access patterns to cloud instance metadata service tokens or IAM role credentials originating from the notebook host.

Detection Strategies

Inspect Open Notebook access logs for /api/sources calls submitted by low-privilege accounts with unusual URL targets.
Correlate application-layer request logs with host network telemetry to identify server-initiated connections to internal destinations that follow API activity.
Alert on any egress from the application server to IMDS endpoints, which should not occur during normal source ingestion.

Monitoring Recommendations

Enable verbose request logging on the sources router and forward it to a centralized logging platform for retrospective search.
Baseline the expected outbound destinations of the Open Notebook process and alert on deviations, particularly to RFC1918 ranges.
Monitor cloud audit logs for anomalous use of instance role credentials assigned to the host running Open Notebook.

How to Mitigate CVE-2026-90769

Immediate Actions Required

Upgrade Open Notebook to version 1.11.0 or later, which introduces the validate_url check in the source ingestion path.
Restrict access to the /api/sources endpoint to trusted users and enforce least-privilege authentication on all Open Notebook accounts.
Rotate any cloud credentials, API tokens, or secrets accessible from the application server's metadata service if exploitation is suspected.

Patch Information

The upstream fix is committed in GitHub Commit 9045ea5 and tracked in GitHub Issue #1284. Additional context is available in the VulnCheck Advisory for Open Notebook and the GitHub Source Code - sources.py reference for the pre-patch handler.

Workarounds

Place the Open Notebook server behind an egress proxy that denies requests to link-local, loopback, and RFC1918 destinations.
Apply host firewall rules blocking outbound connections from the application process to 169.254.169.254 and internal management subnets.
Where supported, enforce IMDSv2 with hop-limit 1 on cloud instances to reduce the value of SSRF against metadata endpoints.

bash

# Example egress restriction using iptables on the Open Notebook host
iptables -A OUTPUT -m owner --uid-owner opennotebook -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner opennotebook -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner opennotebook -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner opennotebook -d 192.168.0.0/16 -j REJECT