{"id":"CVE-2026-102923","kind":"vulnerability","aliases":["CVE-2026-102923"],"related":[],"title":"SparkyFitness: custom AI service URL enables server-side request forgery","description":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.","summary":"SparkyFitness, a self-hosted health tracker, does not validate destination URLs entered for custom AI services in its chat and label-scan flows. A logged-in user can make the server send POST requests with a chosen bearer value to internal services and read the AI system prompt.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-features","node.js","package","self-hosted","sparkyfitness"],"not_affected_if":["managed-hosting","no-custom-ai-service-urls","version-1.6.0-or-later"],"how_to_check":"- Check the installed SparkyFitness version; versions before `1.6.0` are affected.\n- Look in the admin or user AI service settings for any custom AI service URL that points at internal addresses.\n- Review server logs for outbound requests from the SparkyFitness server to internal hosts.","fix":"- Upgrade SparkyFitness to `1.6.0` or later.\n- Until upgraded, restrict who can save custom AI service settings and block the server's outbound access to internal networks.","status":"open","published_at":"2026-10-16T16:16:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:32+00:00","updated_at":"2026-10-25T04:18:32+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:18:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SparkyFitness to `1.6.0` or later.\n- Until upgraded, restrict who can save custom AI service settings and block the server's outbound access to internal networks.","reach":"network","title":"SparkyFitness: custom AI service URL enables server-side request forgery","impact":"medium","summary":"SparkyFitness, a self-hosted health tracker, does not validate destination URLs entered for custom AI services in its chat and label-scan flows. A logged-in user can make the server send POST requests with a chosen bearer value to internal services and read the AI system prompt.","category":"package","nicknames":[],"who_cares":["self-hosted","sparkyfitness","node.js","ai-features"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server sends authenticated requests to internal services and leaks the AI system prompt.","analyst_note":"","how_to_check":"- Check the installed SparkyFitness version; versions before `1.6.0` are affected.\n- Look in the admin or user AI service settings for any custom AI service URL that points at internal addresses.\n- Review server logs for outbound requests from the SparkyFitness server to internal hosts.","needs_analyst":false,"not_affected_if":["version-1.6.0-or-later","no-custom-ai-service-urls","managed-hosting"],"who_is_affected":"Self-hosted SparkyFitness instances older than 1.6.0 where users can save a custom AI service URL and run the chat or label-scan features. The server must be able to reach internal services for the probing to matter. Instances on 1.6.0 or later, or with no custom AI service support in use, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3422,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102923':14A,17A '-2026':13A,16A '1.6.0':95C,167C 'affect':121C 'ai':3A,19B,42B,75B,85C,106C,115C,122C,130C,158C 'ai-featur':18B 'ai-pow':84C 'authent':110C 'bearer':67B,150C 'chat':46B 'chosen':66B 'control':149C 'custom':2A,41B,105C,114C,129C 'cve':12A,15A 'destin':37B,102C 'disclos':156C 'enabl':6A 'enter':39B 'exploit':139C 'famili':92C 'featur':20B 'fit':89C 'fix':164C 'flow':51B,123C 'forgeri':11A 'health':32B,87C 'host':25B,31B,83C 'intern':70B,153C 'invok':119C 'issu':162C 'label':49B 'label-scan':48B 'log':54B 'logged-in':53B 'make':58B 'node.js':21B 'outbound':136C 'packag':22B 'post':62B,145C 'power':86C 'prior':93C 'probe':152C 'prompt':77B,160C 'read':73B 'request':10A,63B,137C,146C 'save':112C,127C 'scan':50B 'self':24B,30B,82C 'self-host':23B,29B,81C 'send':61B,141C 'server':8A,60B,143C 'server-sid':7A,142C 'servic':4A,43B,71B,107C,116C,131C,154C 'set':108C 'side':9A,144C 'sparkyfit':1A,26B,27B,78C 'sparkyfitnessserver/services/chatservice.ts':96C 'sparkyfitnessserver/services/labelscanservice.ts':98C 'success':138C 'suppli':103C 'system':76B,159C 'tracker':33B,90C 'trigger':134C 'url':5A,38B,117C,132C 'user':56B,111C,125C 'valid':36B,101C 'valu':68B,151C 'version':166C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SparkyFitness instances older than 1.6.0 where users can save a custom AI service URL and run the chat or label-scan features. The server must be able to reach internal services for the probing to matter. Instances on 1.6.0 or later, or with no custom AI service support in use, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102923","severity":null,"published_at":"2026-10-16T16:16:52+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}