{"id":"CVE-2026-121561","kind":"vulnerability","aliases":["CVE-2026-121561"],"related":[],"title":"Label Studio: image export lets logged-in users reach internal URLs and steal tokens","description":"Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.","summary":"Label Studio, a data labeling tool used to prepare training data for AI models, has a server-side request forgery flaw in its image-bearing export formats. An authenticated user can make the server fetch internal URLs and read the responses, and can spoof the Host header to capture the organization owner's API token.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","label-studio","ml-data-labeling","python","self-hosted"],"not_affected_if":["managed-hosting","no-internal-network-access"],"how_to_check":"- Check the installed Label Studio version with `label-studio --version` or the version shown in the web interface.\n- Check the installed label-studio-sdk version with `pip show label-studio-sdk`.\n- Note whether the instance is reachable by users who are not trusted.","fix":"- Label Studio: move to `1.23.2` or later.\n- label-studio-sdk: move to `2.1.2` or later.","status":"open","published_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:23:50+00:00","updated_at":"2026-11-03T16:23:50+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-03T16:23:50Z","model":"claude-haiku-5-5","output":{"fix":"- Label Studio: move to `1.23.2` or later.\n- label-studio-sdk: move to `2.1.2` or later.","reach":"network","title":"Label Studio: image export lets logged-in users reach internal URLs and steal tokens","impact":"high","summary":"Label Studio, a data labeling tool used to prepare training data for AI models, has a server-side request forgery flaw in its image-bearing export formats. An authenticated user can make the server fetch internal URLs and read the responses, and can spoof the Host header to capture the organization owner's API token.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["label-studio","self-hosted","python","ml-data-labeling"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads internal services and steals the organization owner's API token","analyst_note":"Confirm whether the SDK fix is needed separately from the server fix and check the vendor advisory and VulnCheck page for the exact affected export paths.","how_to_check":"- Check the installed Label Studio version with `label-studio --version` or the version shown in the web interface.\n- Check the installed label-studio-sdk version with `pip show label-studio-sdk`.\n- Note whether the instance is reachable by users who are not trusted.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","no-internal-network-access"],"who_is_affected":"Teams running a self-hosted Label Studio instance where users have accounts and can import tasks and export image data. The risk depends on whether the server can reach internal services that a user should not see. Instances used only by a single trusted person or with no internal network reach are less exposed, but the sources do not quantify this further.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4225,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121561':18A,21A '-2026':17A,20A '1.23.2':96C '2.1.2':102C 'ai':23B,48B 'ai-tool':22B 'allow':112C 'api':91B,154C 'attack':125C 'authent':66B,113C 'bear':62B,122C 'captur':86B,149C 'coco':139C 'contain':103C 'cve':16A,19A 'data':30B,39B,46B 'data.image':130C 'export':4A,63B,123C,135C 'fetch':72B 'flaw':57B 'forgeri':56B,109C 'format':64B,124C 'header':84B 'host':35B,83B,147C 'imag':3A,61B,121C,141C 'image-bear':60B,120C 'import':127C 'intern':11A,73B,117C,133C 'label':1A,26B,31B,36B,40B,93C,98C 'label-studio':25B 'label-studio-sdk':97C 'let':5A 'log':7A 'logged-in':6A 'make':69B 'ml':29B 'ml-data-label':28B 'model':49B 'organ':88B,151C 'owner':89B,152C 'point':131C 'prepar':44B 'python':32B 'reach':10A 'read':76B,116C,143C 'request':55B,108C 'respons':78B,144C 'sdk':100C 'self':34B 'self-host':33B 'server':53B,71B,106C 'server-sid':52B,105C 'servic':134C 'side':54B,107C 'spoof':81B,146C 'steal':14A 'studio':2A,27B,37B,94C,99C 'task':128C 'token':15A,92B,155C 'tool':24B,41B 'train':45B 'url':12A,74B,118C 'use':42B 'user':9A,67B,114C 'vulner':110C 'yolo':137C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Label Studio instance where users have accounts and can import tasks and export image data. The risk depends on whether the server can reach internal services that a user should not see. Instances used only by a single trusted person or with no internal network reach are less exposed, but the sources do not quantify this further.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","labelstudio","mldatalabeling","python","selfhosted"],"first_public_at":"2026-09-29T14:48:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121561","severity":null,"published_at":"2026-11-03T16:17:28+00:00","modified_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58859,"url":"https://github.com/HumanSignal/label-studio-sdk/commit/c20c899aaaa302740dacd46a47e5774bb677561f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58860,"url":"https://github.com/HumanSignal/label-studio/commit/df96d79183156e556d91825d15fa7721f1145e1a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58861,"url":"https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6437-7wc6-gmx5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-29T14:48:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58862,"url":"https://www.vulncheck.com/advisories/label-studio-before-1.23.2-ssrf-and-token-disclosure-via-image-export-downloads","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}