CVE-2026-9813: FlowIntel SSRF Vulnerability

CVE-2026-9813 Overview

CVE-2026-9813 is a Server-Side Request Forgery (SSRF) vulnerability affecting FlowIntel versions up to and including 3.3.0. The flaw resides in the external reference URL probe functionality implemented in app/case/task.py. An authenticated user who can submit an external reference URL can force the application server to issue an HTTP HEAD request to an attacker-controlled destination. Because the application does not adequately validate the URL scheme or the resolved destination address, requests can target loopback, link-local, private, reserved, or other restricted network ranges. This exposes internal services and cloud metadata endpoints reachable from the FlowIntel server.

Critical Impact

Authenticated attackers can pivot the FlowIntel server into internal networks and query cloud metadata endpoints, potentially exposing credentials and internal service data.

Affected Products

• FlowIntel versions up to and including 3.3.0
• Component: app/case/task.py external reference URL probe
• Weakness category: [CWE-918] Server-Side Request Forgery

Discovery Timeline

• 2026-05-28 - CVE-2026-9813 published to the National Vulnerability Database (NVD)
• 2026-05-28 - Last updated in NVD database
• Patch commit - Fix committed to the FlowIntel repository under commit 68b523b

Technical Details for CVE-2026-9813

Vulnerability Analysis

FlowIntel accepts external reference URLs from authenticated users and probes them with an HTTP HEAD request to gather metadata. The probe logic in app/case/task.py uses the requests library to issue outbound traffic but does not restrict the URL scheme or filter the resolved IP address. Attackers can supply URLs that reference internal hostnames, IPv4 loopback addresses such as 127.0.0.1, link-local ranges like 169.254.169.254, or RFC1918 private space. The server then performs the request from its own network context, bypassing perimeter controls.

Root Cause

The root cause is insufficient validation of user-supplied URLs prior to making an outbound request. Specifically, the original handler did not import or use IP address parsing utilities such as ipaddress, socket, or urllib.parse.urlparse to enforce scheme and destination allowlists. Without resolving the hostname and checking the resulting address against blocked ranges, the application trusts attacker-controlled input.

Attack Vector

An authenticated low-privilege user submits a crafted external reference URL through the case management interface. The server resolves the hostname and issues an HTTP HEAD request to the destination. By targeting http://169.254.169.254/latest/meta-data/ on AWS, internal admin panels, or file:// and gopher:// schemes if accepted, the attacker can enumerate internal services or extract instance metadata.

# Patch in app/case/task.py - imports added to enable SSRF defenses
 import ast
+import ipaddress
 import os
+import socket
 import uuid
 
 import requests
 
 from datetime import datetime
 from flask import Blueprint, render_template, redirect, jsonify, request, flash, current_app
+from urllib.parse import urlparse
 
 from app.db_class.db import Case, User, db, Note

Source: FlowIntel commit 68b523b. The patch introduces ipaddress, socket, and urlparse to validate URL schemes and resolve destination addresses before issuing the probe request, allowing the application to reject loopback and private ranges.

Detection Methods for CVE-2026-9813

Indicators of Compromise

• Outbound HTTP HEAD requests from the FlowIntel server process to 169.254.169.254, 127.0.0.0/8, or RFC1918 ranges.
• Application logs in app/case/task.py showing external reference URL submissions referencing internal hostnames or non-HTTP schemes.
• Unexpected DNS resolutions for internal infrastructure originating from the FlowIntel host.

Detection Strategies

• Inspect web proxy and egress firewall logs for HEAD requests from the FlowIntel server destined for internal or metadata IP ranges.
• Audit FlowIntel case records and database entries for external reference URLs containing private IP literals, localhost, or unusual schemes.
• Correlate authenticated user activity with anomalous outbound request patterns from the application server.

Monitoring Recommendations

• Enforce egress filtering on the FlowIntel host and alert on any connection attempts to link-local or private ranges.
• Enable verbose request logging on the FlowIntel requests client to capture target URLs and response codes.
• Monitor cloud audit logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for unexpected instance metadata service queries.

How to Mitigate CVE-2026-9813

Immediate Actions Required

• Upgrade FlowIntel to a version that includes commit 68b523b or later.
• Restrict who can submit external reference URLs by tightening role-based access controls in FlowIntel.
• Block the FlowIntel server from reaching the cloud metadata IP 169.254.169.254 at the network or IMDSv2 enforcement layer.

Patch Information

The fix is published in the FlowIntel repository as commit 68b523b47854c54bf36fd706c0fd5353063b5409. It adds URL parsing and address resolution checks to the external reference probe in app/case/task.py, rejecting non-HTTP(S) schemes and requests targeting loopback, link-local, private, or reserved address ranges. See the FlowIntel security commit for the complete diff.

Workarounds

• Deploy an egress proxy that allowlists only external destinations required by FlowIntel and drops traffic to private ranges.
• Run the FlowIntel container or host in a network segment with no route to internal management interfaces.
• Enforce IMDSv2 on AWS instances hosting FlowIntel to block unauthenticated metadata queries originating from SSRF.

# iptables egress restriction example for the FlowIntel host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT