Live › vulnerability › CVE-2026-114374
Go to dashboardThe fetch-metadata endpoint in wiki-go up to 1.9.1 does not properly control URLs it requests, enabling server-side request forgery. A remote attacker can make the server send requests to hosts of their choosing, which can reach internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of wiki-go at version 1.9.1 or earlier that expose the fetch-metadata endpoint to users are exposed. The sources do not say whether the endpoint is on by default or needs an account, so unknown. Instances that do not run wiki-go, or that run 1.9.2 or later, can skip it.
No product ranges from the sources yet.
1.9.2internal/handlers/metadata_api.go in the source tree1.9.2 (patch 25498ebf5c012b870967e38eec2a1e5133fa1a83)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
This page as .md · .json · in your agent: get_signal("CVE-2026-114374")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.