CVE-2026-9372 Overview
CVE-2026-9372 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting ItzCrazyKns Vane versions up to 1.12.1. The flaw resides in the Model Provider API component, specifically in the src/app/api/providers/route.ts file. Attackers manipulate the baseURL argument to coerce the server into issuing arbitrary outbound HTTP requests. Remote exploitation requires no authentication or user interaction. The exploit has been published, and the maintainer was notified through an issue report but has not responded.
Critical Impact
Unauthenticated remote attackers can abuse the Vane Model Provider API to issue server-originated requests to arbitrary internal or external endpoints, enabling reconnaissance of internal networks and potential access to metadata services.
Affected Products
- ItzCrazyKns Vane versions up to and including 1.12.1
- Model Provider API component (src/app/api/providers/route.ts)
- Deployments exposing the Vane API endpoint to untrusted networks
Discovery Timeline
- 2026-05-24 - CVE-2026-9372 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9372
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery flaw classified under [CWE-918]. The affected route accepts a user-controlled baseURL parameter intended to designate the model provider endpoint. Vane forwards requests to the value supplied in baseURL without validating the destination host, scheme, or address family.
Attackers can supply URLs pointing to internal IP ranges, loopback addresses, link-local metadata services such as 169.254.169.254, or arbitrary external systems. The server then performs the request and may return response content to the attacker. The vulnerability is reachable over the network without authentication, which lowers the barrier for exploitation considerably.
According to the EPSS model dated 2026-05-28, the probability of exploitation in the wild remains low at the time of publication. The exploit code is publicly available, and the project has not yet acknowledged the disclosure.
Root Cause
The root cause is missing input validation on the baseURL argument processed by the Model Provider API handler in src/app/api/providers/route.ts. The handler trusts the supplied URL and uses it directly to construct outbound HTTP requests. No allowlist, scheme restriction, or DNS rebinding protection exists in the affected code path.
Attack Vector
An attacker sends a crafted HTTP request to the Vane providers API endpoint with a malicious baseURL value. The server resolves and connects to the supplied destination, then relays the response. Attackers commonly target cloud metadata endpoints, internal admin panels, and unauthenticated services bound to localhost.
No verified exploit code is reproduced here. Refer to the GitHub Issue #1124 and the VulDB #365336 entry for technical details on the public proof of concept.
Detection Methods for CVE-2026-9372
Indicators of Compromise
- Outbound HTTP requests from the Vane application server to internal RFC1918 ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Unusual POST requests to /api/providers containing baseURL values referencing non-public hosts or unexpected schemes.
- Application logs showing provider configuration changes from untrusted source IP addresses.
Detection Strategies
- Inspect web server access logs for requests to the providers route originating from unauthenticated sessions.
- Correlate inbound API requests with outbound network connections from the Vane process to identify SSRF traffic patterns.
- Deploy egress filtering alerts that flag requests from application servers toward metadata IPs or private subnets.
Monitoring Recommendations
- Capture and review all values of the baseURL parameter sent to the Vane Model Provider API endpoint.
- Monitor process-level network telemetry from the Node.js runtime hosting Vane for anomalous outbound destinations.
- Alert on response size or latency spikes on the providers route, which can indicate SSRF data exfiltration.
How to Mitigate CVE-2026-9372
Immediate Actions Required
- Restrict network exposure of the Vane application so that only trusted clients can reach the /api/providers endpoint.
- Block outbound traffic from the Vane host to cloud metadata services, loopback ranges, and internal management subnets using host or network firewalls.
- Require authentication in front of the Vane API using a reverse proxy until an upstream patch is available.
Patch Information
No official patch is available at the time of publication. The maintainer was notified through GitHub Issue #1124 but has not responded. Track the Vane repository for fixes addressing the baseURL validation logic in src/app/api/providers/route.ts.
Workarounds
- Implement a reverse proxy filter that rejects requests where the baseURL parameter resolves to private, loopback, or link-local addresses.
- Apply egress firewall rules that deny outbound connections from the Vane application server to non-approved destinations.
- Run Vane inside a network namespace or container with no route to internal management networks or cloud metadata services.
# Example iptables egress rules blocking SSRF targets from the Vane host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
