CVE-2026-92795: Coze Studio SSRF Vulnerability

CVE-2026-92795 Overview

CVE-2026-92795 is a Server-Side Request Forgery (SSRF) vulnerability in Coze Studio through version 0.5.1. The flaw resides in the plugin tool registration flow, where the backend fails to restrict the server URL supplied by authenticated users. Attackers can register plugin tools pointing at internal endpoints, causing the backend to fetch resources on their behalf. This exposes cloud metadata services and internal-only APIs that would otherwise be unreachable from the internet. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot through Coze Studio's backend to read cloud metadata credentials and interact with internal services, enabling credential theft and lateral movement inside the hosting environment.

Affected Products

Coze Studio versions up to and including 0.5.1
Coze Studio plugin tool invocation component (backend/domain/plugin/service/tool/invocation_http.go)
Self-hosted Coze Studio deployments exposing plugin registration to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92795 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92795

Vulnerability Analysis

Coze Studio allows authenticated users to register plugin tools that the backend invokes over HTTP. During plugin registration, the user supplies the target server URL for the tool. The backend accepts this URL without validating the host, scheme, or destination network range. When the plugin executes, the Coze Studio backend issues an outbound HTTP request to the attacker-controlled URL from its own network position.

Because the request originates from the backend, it bypasses network segmentation that normally protects internal-only assets. Attackers can direct the fetch to loopback addresses, RFC1918 ranges, or cloud provider metadata endpoints such as 169.254.169.254. The response body is returned through the plugin invocation path, allowing the attacker to read sensitive content including instance credentials, service tokens, and internal API data.

Root Cause

The root cause is missing destination validation in the HTTP invocation logic at backend/domain/plugin/service/tool/invocation_http.go lines 127-146. The function trusts the registered server URL and forwards the request without enforcing an allowlist, denylist of private ranges, or DNS rebinding protections. See the upstream code snippet and issue #2711.

Attack Vector

An authenticated user registers a plugin tool with a server_url pointing at an internal target, then triggers the tool. The backend performs the outbound request and returns the response body to the caller. Full technical details are documented in the VulnCheck SSRF Advisory for Coze Studio.

No verified proof-of-concept code is available. The exploitation pattern follows standard SSRF against cloud metadata services and internal HTTP endpoints reachable from the Coze Studio backend.

Detection Methods for CVE-2026-92795

Indicators of Compromise

Outbound HTTP requests from Coze Studio backend hosts to 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Plugin registrations containing server URLs referencing loopback (127.0.0.1, localhost) or RFC1918 addresses.
Unexpected plugin invocation entries in Coze Studio logs targeting internal service ports.

Detection Strategies

Audit the Coze Studio plugin registry for tools whose configured server_url resolves to private, link-local, or metadata addresses.
Inspect backend egress traffic for HTTP responses containing IAM credentials, tokens, or instance identity documents.
Correlate authenticated user sessions with plugin creation events followed by anomalous outbound requests.

Monitoring Recommendations

Enable network flow logging on Coze Studio backend hosts and alert on connections to 169.254.0.0/16 and internal management CIDRs.
Forward Coze Studio application and audit logs to a centralized SIEM for retention and correlation.
Monitor cloud provider audit trails for unusual use of instance role credentials originating from Coze Studio infrastructure.

How to Mitigate CVE-2026-92795

Immediate Actions Required

Restrict Coze Studio plugin registration to trusted operators until a patched build is deployed.
Block backend egress to 169.254.169.254 and other cloud metadata endpoints using host firewalls or security groups.
Rotate any cloud credentials, API keys, or service tokens accessible from the Coze Studio backend network.
Review plugin registry history for tools created by non-administrative accounts and remove suspicious entries.

Patch Information

At time of publication, no fixed release is identified in the NVD entry. Monitor the Coze Studio GitHub repository and issue #2711 for a patched version beyond 0.5.1. Apply the update as soon as it is published by the maintainers.

Workarounds

Enforce IMDSv2 on AWS instances hosting Coze Studio so the metadata endpoint requires session tokens.
Place the Coze Studio backend behind an egress proxy that denies requests to private and link-local address ranges.
Validate and allowlist plugin server URLs at the reverse proxy layer using host header and DNS resolution checks.
Remove instance role permissions that are not required for Coze Studio operation to limit blast radius.

bash

# Example egress restriction using iptables on the Coze Studio backend host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8   ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8    -m owner --uid-owner coze -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner coze -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner coze -j REJECT