{"id":"CVE-2026-116000","kind":"vulnerability","aliases":["CVE-2026-116000"],"related":[],"title":"PrivateGPT: URI loader lets remote users trigger server-side request forgery","description":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Zylon PrivateGPT 1.0.0 and 1.0.1 have a server-side request forgery flaw in the load_file_from_uri function, which fetches files from URLs supplied in ingest requests. A remote attacker can make the server send requests to URLs of their choice, such as internal services, which can expose internal data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","privategpt","python","rag","self-hosted"],"not_affected_if":["no-uri-ingest","other-versions"],"how_to_check":"- Check the installed PrivateGPT version in the project's package metadata or deployment config, looking for `1.0.0` or `1.0.1`\n- Confirm whether the ingest endpoint that calls private_gpt/server/ingest/uri_loader.py is reachable from untrusted networks","fix":"- No vendor fix is stated in the sources; unknown\n- Until a fixed release is confirmed, restrict network access to the PrivateGPT server and block outbound requests from it to internal addresses","status":"open","published_at":"2026-10-25T03:16:26+00:00","first_seen_at":"2026-10-25T04:02:13+00:00","triaged_at":"2026-10-25T04:03:23+00:00","updated_at":"2026-10-25T04:03:23+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:03:23Z","model":"claude-haiku-5-5","output":{"fix":"- No vendor fix is stated in the sources; unknown\n- Until a fixed release is confirmed, restrict network access to the PrivateGPT server and block outbound requests from it to internal addresses","reach":"internet","title":"PrivateGPT: URI loader lets remote users trigger server-side request forgery","impact":"medium","summary":"Zylon PrivateGPT 1.0.0 and 1.0.1 have a server-side request forgery flaw in the load_file_from_uri function, which fetches files from URLs supplied in ingest requests. A remote attacker can make the server send requests to URLs of their choice, such as internal services, which can expose internal data.","category":"ai-tooling","nicknames":[],"who_cares":["privategpt","self-hosted","python","rag"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server makes attacker-chosen internal requests, leaking internal service data","analyst_note":"Confirm whether authentication is required for the ingest endpoint and find the upstream fixed version; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116000 gives no fix or auth detail.","how_to_check":"- Check the installed PrivateGPT version in the project's package metadata or deployment config, looking for `1.0.0` or `1.0.1`\n- Confirm whether the ingest endpoint that calls private_gpt/server/ingest/uri_loader.py is reachable from untrusted networks","needs_analyst":true,"not_affected_if":["other-versions","no-uri-ingest"],"who_is_affected":"Deployments running Zylon PrivateGPT 1.0.0 or 1.0.1 with the URI ingest path reachable by users who can send requests. Teams on other versions or without the URI loader exposed can likely skip it, but the sources do not confirm which versions are fixed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":3383,"output_tokens":677,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116000':15A,18A '-2026':14A,17A '/1.0.1':90C '1.0.0':30B,89C '1.0.1':32B 'affect':93C 'ai':20B 'ai-tool':19B 'argument':116C 'artifact':109C 'attack':59B,131C,146C 'choic':70B 'compon':107C 'contact':150C 'cve':13A,16A 'data':79B 'disclosur':154C 'discov':85C 'earli':151C 'exploit':134C 'expos':77B 'fetch':49B 'file':44B,50B,97C,102C 'flaw':40B,82C 'forgeri':12A,39B,124C 'function':47B,95C 'gpt/server/ingest/uri_loader.py':104C 'host':27B 'ingest':55B 'initi':129C 'intern':73B,78B 'let':4A 'load':43B,96C 'loader':3A,110C 'make':61B 'manipul':113C 'may':142C 'perform':111C 'possibl':127C 'privat':103C 'privategpt':1A,22B,29B,88C 'public':140C 'python':23B 'rag':24B 'releas':137C 'remot':5A,58B,132C 'request':11A,38B,56B,65B,123C 'respond':158C 'result':118C 'secur':81C 'self':26B 'self-host':25B 'send':64B 'server':9A,36B,63B,121C 'server-sid':8A,35B,120C 'servic':74B 'side':10A,37B,122C 'suppli':53B 'tool':21B 'trigger':7A 'uri':2A,46B,99C,108C 'url':52B,67B 'use':144C 'user':6A 'valu':117C 'vendor':148C 'vulner':92C 'way':161C 'zylon':28B,87C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Zylon PrivateGPT 1.0.0 or 1.0.1 with the URI ingest path reachable by users who can send requests. Teams on other versions or without the URI loader exposed can likely skip it, but the sources do not confirm which versions are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T03:16:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116000","severity":null,"published_at":"2026-10-25T03:16:26+00:00","modified_at":"2026-10-25T03:16:26+00:00","first_seen_at":"2026-10-25T04:02:13+00:00","fetched_at":"2026-10-25T04:02:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}