CVE-2026-9464 Overview
CVE-2026-9464 is a server-side request forgery (SSRF) vulnerability in YunaiV yudao-cloud version 2026.03. The flaw affects the IotDataSinkHttpConfig function exposed through the /admin-api/iot/data-sink/create endpoint within the Admin API component. An authenticated attacker with high privileges can manipulate the HTTP data sink configuration to coerce the server into issuing arbitrary outbound requests. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor was contacted before public disclosure but did not respond.
Critical Impact
Authenticated attackers can leverage the Admin API to issue server-side requests to internal services, enabling reconnaissance of internal infrastructure and potential interaction with otherwise unreachable systems [CWE-918].
Affected Products
- YunaiV yudao-cloud 2026.03
- IotDataSinkHttpConfig function in the Admin API
- /admin-api/iot/data-sink/create endpoint
Discovery Timeline
- 2026-05-25 - CVE-2026-9464 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9464
Vulnerability Analysis
The vulnerability exists in the IoT data sink configuration logic of yudao-cloud. The IotDataSinkHttpConfig handler accepts a user-supplied URL intended to represent an external HTTP destination for telemetry data. The server then issues outbound HTTP requests to that destination without sufficient validation of the target host. An attacker submits a crafted configuration referencing internal hosts, loopback addresses, or cloud metadata endpoints. The server performs the request on behalf of the attacker and may return response content or status information.
The attack requires network access to the Admin API and an authenticated session with high privileges. No user interaction is required. Public disclosure of exploit details on GitHub lowers the technical barrier for reproduction.
Root Cause
The root cause is missing or insufficient validation of the destination URL supplied to IotDataSinkHttpConfig. The handler does not enforce an allowlist of permitted hosts, does not reject private address ranges, and does not block metadata service endpoints such as 169.254.169.254. This places the flaw squarely within [CWE-918] Server-Side Request Forgery.
Attack Vector
An authenticated administrator with access to the IoT data sink creation API sends a POST request to /admin-api/iot/data-sink/create containing a malicious target URL. The application instantiates an HTTP client and issues the request from the server context. Internal services, management interfaces, and cloud instance metadata become reachable through this proxy behavior.
For technical reproduction details, see the GitHub Bug Report and the VulDB Vulnerability #365445 entry.
Detection Methods for CVE-2026-9464
Indicators of Compromise
- POST requests to /admin-api/iot/data-sink/create containing URLs targeting private RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
- Unexpected outbound HTTP connections originating from the yudao-cloud application server toward internal hosts or cloud metadata endpoints.
- Newly created data sink records with non-business HTTP destinations or unusual ports.
Detection Strategies
- Inspect Admin API access logs for IotDataSinkHttpConfig configuration changes and correlate with the originating administrator account.
- Baseline legitimate outbound destinations from the application tier and alert on deviations consistent with SSRF probing.
- Apply WAF or reverse proxy rules that inspect JSON bodies submitted to /admin-api/iot/data-sink/create for internal address literals.
Monitoring Recommendations
- Forward Admin API audit logs and application egress flow data to a centralized analytics platform for correlation.
- Monitor for repeated 4xx or 5xx responses on outbound requests initiated by the data sink subsystem, which may indicate enumeration.
- Track administrative session activity for privilege misuse, particularly around IoT configuration endpoints.
How to Mitigate CVE-2026-9464
Immediate Actions Required
- Restrict access to /admin-api/iot/data-sink/create to a minimal set of trusted administrators through network and identity controls.
- Audit existing IoT data sink configurations and remove any entries pointing to internal addresses or unexpected hosts.
- Block outbound traffic from the application server to internal management networks and cloud metadata services using egress firewall rules.
Patch Information
The vendor was contacted prior to public disclosure but did not respond, and no official patch is referenced in the available advisories. Operators should track the VulDB Vulnerability #365445 entry and the upstream yudao-cloud project for remediation updates.
Workarounds
- Place yudao-cloud behind a forward proxy that enforces an allowlist of approved external sink destinations.
- Deploy WAF rules that reject Admin API payloads containing private IP ranges, loopback addresses, or metadata service hostnames.
- Rotate administrator credentials and enforce strong authentication on the Admin API to reduce exposure of the high-privilege precondition.
# Example egress restriction using iptables on the application host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
