---
id: "CVE-2026-121561"
kind: "vulnerability"
aliases: ["CVE-2026-121561"]
title: "Label Studio: image export lets logged-in users reach internal URLs and steal tokens"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "label-studio", "ml-data-labeling", "python", "self-hosted"]
not_affected_if: ["managed-hosting", "no-internal-network-access"]
published_at: "2026-11-03T16:17:28+00:00"
first_seen_at: "2026-11-03T16:21:44+00:00"
updated_at: "2026-11-03T16:23:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121561", "first_seen_at": "2026-11-03T16:21:44+00:00"}]
---

# Label Studio: image export lets logged-in users reach internal URLs and steal tokens

Label Studio, a data labeling tool used to prepare training data for AI models, has a server-side request forgery flaw in its image-bearing export formats. An authenticated user can make the server fetch internal URLs and read the responses, and can spoof the Host header to capture the organization owner's API token.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Label Studio version with `label-studio --version` or the version shown in the web interface.
- Check the installed label-studio-sdk version with `pip show label-studio-sdk`.
- Note whether the instance is reachable by users who are not trusted.

## Fix

- Label Studio: move to `1.23.2` or later.
- label-studio-sdk: move to `2.1.2` or later.

## Timeline

- 2026-11-03T16:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121561

## Documents

- [advisory] Vendor advisory: github.com https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6437-7wc6-gmx5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/label-studio-before-1.23.2-ssrf-and-token-disclosure-via-image-export-downloads
- [fix] Patch: github.com https://github.com/HumanSignal/label-studio-sdk/commit/c20c899aaaa302740dacd46a47e5774bb677561f
- [fix] Patch: github.com https://github.com/HumanSignal/label-studio/commit/df96d79183156e556d91825d15fa7721f1145e1a

## From the sources

Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_