Live › vulnerability › CVE-2026-116280
Go to dashboardKameleo up to 5.0.1.26 has a flaw in its proxy validation function InternalController.TestProxy, where the host and port arguments are not properly checked. A remote attacker can abuse it to make the server send requests to hosts of the attacker's choosing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams running Kameleo 5.0.1.26 or earlier on a machine reachable over the network, where the proxy test feature is exposed. Sources do not say whether the route requires authentication. Installations already on 5.2.0 or later are not affected by this entry.
No product ranges from the sources yet.
5.0.1.26 or earlier./general/test-proxy is in use by any internal tooling, since the old route was removed in 5.2.0.5.2.0 or later, which removes the affected route and replaces it with /general/test-proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may be launched remotely. Upgrading to version 5.2.0 is able to address this issue. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-116280")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.