Live › vulnerability › CVE-2026-119709
Grimoire before 1.0.0 has a POST endpoint, /api/fetch-metadata, that fetches any URL it is given without checking who is asking. An attacker can point it at loopback, internal network or cloud metadata addresses and read back the title, description and page content it returns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams running Grimoire before 1.0.0 where the /api/fetch-metadata endpoint is reachable by untrusted callers. Instances on a private network with no outside access, or on a version of 1.0.0 or later, are not exposed. The sources do not describe further configuration conditions.
No product ranges from the sources yet.
1.0.0./api/fetch-metadata route in the deployed application.1.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.
This page as .md · .json · in your agent: get_signal("CVE-2026-119709")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.