CVE-2026-91081: Docs SSRF Vulnerability in CORS Proxy

CVE-2026-91081 Overview

CVE-2026-91081 is a server-side request forgery (SSRF) vulnerability affecting Docs through version 5.6.1. The flaw resides in the cors-proxy endpoint, which accepts a public document UUID from unauthenticated attackers and issues outbound HTTP requests on their behalf. Attackers can weaponize DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypasses to reach internal network resources. Successful exploitation allows exfiltration of image content from systems the Docs backend can access. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can pivot through the Docs backend to reach internal-only services and retrieve image content that would otherwise be inaccessible from the public internet.

Affected Products

Docs (suitenumerique/docs) versions up to and including 5.6.1
Deployments exposing the cors-proxy endpoint to untrusted networks
Self-hosted Docs instances co-located with internal-only services

Discovery Timeline

2026-09-14 - CVE-2026-91081 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-91081

Vulnerability Analysis

The cors-proxy endpoint in Docs is designed to fetch remote image assets referenced by public documents and relay them to browsers, circumventing browser-enforced cross-origin restrictions. The endpoint accepts a public document UUID and does not require authentication. Because the proxy issues outbound requests from the server, an attacker who controls or influences the target URL can direct those requests at internal infrastructure.

Attackers combine two techniques against the proxy. First, they exploit a DNS TOCTOU race in which the hostname resolves to a permitted address during validation but to an internal address during the subsequent fetch. Second, they abuse shared address space bypasses, using ranges that appear public but route to internal networks. The result is unauthenticated access to internal HTTP services and exfiltration of image content that the server can retrieve.

Root Cause

The root cause is insufficient validation of destination addresses in the cors-proxy handler within src/backend/core/api/viewsets.py. The endpoint performs URL and hostname checks before dispatching the outbound request, but the checks are not atomic with the request itself. Between validation and connection, DNS answers can change, and address-family assumptions can be broken by hosts that resolve to reserved or shared ranges.

Attack Vector

Exploitation requires only network reachability to the Docs application and a public document UUID. No credentials, user interaction, or elevated privileges are needed. An attacker submits a crafted request to the cors-proxy endpoint referencing an attacker-controlled hostname. The controlled DNS server returns a permitted address on the first lookup and an internal address on the second lookup used by the fetch. The backend then connects to an internal service and returns the response body to the attacker. Refer to the VulnCheck SSRF Advisory and GitHub Issue Tracker #2545 for full technical details.

Detection Methods for CVE-2026-91081

Indicators of Compromise

Requests to the cors-proxy endpoint containing hostnames that resolve to RFC1918, loopback, link-local, or cloud metadata ranges such as 169.254.169.254.
Outbound connections originating from the Docs backend to internal IP ranges shortly after cors-proxy requests.
DNS query patterns showing rapid TTL expiration or divergent answers for the same hostname within a short window.
Repeated cors-proxy calls that reference the same document UUID paired with varying target URLs.

Detection Strategies

Instrument the cors-proxy handler to log the resolved IP at the moment of connection and alert on non-public destinations.
Correlate reverse-proxy access logs with backend egress flows to identify request chains that terminate at internal services.
Deploy egress network policies that generate telemetry when the Docs service attempts connections to reserved address ranges.

Monitoring Recommendations

Monitor authentication-optional endpoints for volumetric anomalies and unusual source-IP diversity.
Track DNS resolutions initiated by the Docs backend for hostnames with low TTLs or answers in reserved ranges.
Alert on HTTP response sizes from cors-proxy that deviate from expected image content, which may indicate exfiltration of internal responses.

How to Mitigate CVE-2026-91081

Immediate Actions Required

Restrict access to the cors-proxy endpoint at the reverse proxy or ingress layer until a patched release is deployed.
Enforce egress network controls that block the Docs backend from reaching RFC1918, loopback, link-local, and cloud metadata addresses.
Audit recent access logs for cors-proxy invocations referencing external hostnames that resolve to internal ranges.

Patch Information

At the time of publication, the Docs GitHub repository is the authoritative source for fixes. Administrators should track GitHub Issue #2545 and upgrade to a release later than 5.6.1 that resolves the SSRF condition. Review the vulnerable handlers in viewsets.py and models.py to confirm the fix scope after upgrading.

Workarounds

Disable the cors-proxy endpoint if image proxying is not required by the deployment.
Route Docs backend egress through an outbound proxy that enforces allow-lists for permitted image hosts.
Configure DNS resolution for the Docs backend to reject answers in reserved or shared address ranges.
Require authentication for cors-proxy requests via a reverse-proxy rule while awaiting an upstream fix.

bash

# Configuration example
# Example NGINX rule to require authentication on the cors-proxy endpoint
location /cors-proxy {
    auth_request /_auth;
    proxy_pass http://docs_backend;
}