Live › vulnerability › CVE-2026-121581
ArcReel versions 0.32.0 through 0.34.0 have a flaw in the /api/v1/providers/{id}/test endpoint that lets a remote requester make the server send requests to addresses it chooses (server-side request forgery). An attacker could use the server to reach internal services that are not exposed to the internet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
ArcReel deployments on versions 0.32.0, 0.33.0 and 0.34.0 that expose the provider test-connection endpoint are affected; the sources do not say whether authentication is required. Teams running ArcReel on an internal network with the API not reachable from outside can rank this lower. unknown for anything beyond that.
No product ranges from the sources yet.
0.32.0, 0.33.0 or 0.34.0/api/v1/providers/{id}/test endpoint is reachable from outside your networkNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121581")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.