Live › vulnerability › CVE-2026-119712
PipesHub before 0.10.0 has a server-side request forgery flaw in its image parser, which fetches any image URL embedded in an uploaded document, synced mailbox, or web connector page. An attacker can make the indexing service reach loopback, private-network, or cloud metadata endpoints and get the responses embedded into indexed content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams running PipesHub's indexing service that ingest uploads, synced mailboxes, or web connector content. The risk comes from the indexing service fetching image URLs found in documents, so it can reach hosts the attacker should not see. Deployments already on 0.10.0 or later are not affected.
No product ranges from the sources yet.
0.10.0.ImageParser._fetch_single_url code path in the deployed indexing service.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
This page as .md · .json · in your agent: get_signal("CVE-2026-119712")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.