CVE-2026-91199: Refly SSRF Vulnerability in URL Scraper

CVE-2026-91199 Overview

CVE-2026-91199 is a Server-Side Request Forgery (SSRF) vulnerability in Refly through version 1.1.0. The flaw resides in the POST /v1/misc/scrape endpoint, which fetches caller-supplied URLs without validating the scheme, host, or resolved IP address. Authenticated attackers can coerce the backend into issuing requests to loopback, private, and link-local addresses. This includes cloud metadata services such as 169.254.169.254, allowing disclosure of page titles and descriptions from internal resources. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot from the exposed scrape endpoint to internal services and cloud metadata endpoints, exposing configuration data, service identifiers, and credentials embedded in instance metadata responses.

Affected Products

Refly versions up to and including 1.1.0
Refly API service (apps/api) misc.controller.ts scrape handler
Refly scrape-weblink utility in packages/utils

Discovery Timeline

2026-09-14 - CVE-2026-91199 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91199

Vulnerability Analysis

Refly exposes a scraping endpoint at POST /v1/misc/scrape designed to retrieve metadata such as titles and descriptions from external URLs. The handler in misc.controller.ts passes user-supplied URLs directly to the scrape-weblink utility. That utility issues an outbound HTTP request without inspecting the target scheme, hostname, or resolved network address. Because the request originates from the backend, it inherits the trust boundary of the Refly service host. An authenticated caller can therefore instruct the server to fetch resources normally unreachable from the internet. The returned metadata is reflected to the caller, providing a read primitive against internal HTTP responses.

Root Cause

The root cause is missing input validation in the scrape flow. The handler accepts any URL string and does not enforce an allowlist of schemes such as http or https, nor does it reject private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local addresses (169.254.0.0/16). DNS resolution is also unchecked, permitting DNS rebinding and hostnames that resolve to internal addresses. The URL fetch executes with the network context of the backend container or host.

Attack Vector

An authenticated user submits a crafted URL to the scrape endpoint pointing at an internal address. Typical targets include the cloud instance metadata service at http://169.254.169.254/latest/meta-data/, internal admin panels on 127.0.0.1, and service discovery endpoints in Kubernetes environments. The backend fetches the URL, parses the HTML response for <title> and meta description tags, and returns those fields in the API response. Attackers can enumerate internal hosts, fingerprint services, and extract identifying metadata reflected in HTML titles. See the VulnCheck Advisory for Refly 1.1.0 and GitHub Issue #2280 for reference details.

Detection Methods for CVE-2026-91199

Indicators of Compromise

Outbound HTTP requests from the Refly API service to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
Application logs showing POST /v1/misc/scrape requests with URL parameters targeting internal hostnames or IP literals.
Unusual DNS queries from the Refly backend resolving external hostnames to internal IP ranges.

Detection Strategies

Instrument the scrape handler to log the fully resolved destination address for each outbound fetch and alert on non-public ranges.
Deploy egress network policies that generate telemetry when the Refly workload attempts to reach metadata or private subnets.
Correlate authenticated user sessions with scrape requests to identify accounts probing multiple internal addresses in short intervals.

Monitoring Recommendations

Forward Refly API access logs and container network flow logs to a centralized analytics platform for retrospective hunting.
Baseline normal scrape targets and flag deviations toward internal address space or non-HTTP schemes such as file:// or gopher://.
Monitor cloud metadata endpoint access attempts from application workloads and treat any hit as a high-priority signal.

How to Mitigate CVE-2026-91199

Immediate Actions Required

Restrict access to the /v1/misc/scrape endpoint to trusted user roles or disable it if not required by the deployment.
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS hosts running Refly to require session tokens for metadata access.
Apply egress filtering at the network layer to block Refly workloads from reaching 169.254.169.254, loopback, and private IP ranges.

Patch Information

At the time of publication, no fixed release is referenced in the advisory. Track the upstream project at the Refly GitHub repository and the affected code paths in misc.controller.ts and scrape-weblink.ts for remediation commits. Upgrade to a version beyond 1.1.0 once maintainers publish a fix that validates URL schemes and destination addresses.

Workarounds

Introduce a reverse proxy in front of the Refly API that validates outbound URLs and rejects requests targeting private, loopback, or link-local ranges.
Run the Refly backend in a network namespace or dedicated subnet without routes to internal management networks or metadata services.
Implement a URL allowlist for the scrape function limited to known-good external domains required by business workflows.

bash

# Example AWS CLI enforcement of IMDSv2 to mitigate metadata exposure
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled \
  --http-put-response-hop-limit 1