Live › vulnerability › CVE-2026-116069
Go to dashboardNiubiGEO before 0.3.2 lets any remote caller submit a crafted domain value to POST /audit-plan so the server fetches internal addresses. The responses, including loopback services and cloud metadata, come back in the plan's siteEvidence JSON.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Any NiubiGEO deployment older than 0.3.2 that exposes POST /audit-plan to callers who do not have an account. Instances reachable only from a trusted internal network with no untrusted callers are less exposed. unknown whether the sources name specific hosting setups.
No product ranges from the sources yet.
0.3.2/audit-plan route reachable from outside the network0.3.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
This page as .md · .json · in your agent: get_signal("CVE-2026-116069")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.