{"id":"CVE-2026-121581","kind":"vulnerability","aliases":["CVE-2026-121581"],"related":[],"title":"ArcReel: provider test-connection endpoint allows server-side request forgery","description":"A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"ArcReel versions 0.32.0 through 0.34.0 have a flaw in the /api/v1/providers/{id}/test endpoint that lets a remote requester make the server send requests to addresses it chooses (server-side request forgery). An attacker could use the server to reach internal services that are not exposed to the internet.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arcreel","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed ArcReel version and whether it is `0.32.0`, `0.33.0` or `0.34.0`\n- Check whether the `/api/v1/providers/{id}/test` endpoint is reachable from outside your network","fix":null,"status":"open","published_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:51+00:00","updated_at":"2026-11-03T23:45:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-03T23:45:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ArcReel: provider test-connection endpoint allows server-side request forgery","impact":"medium","summary":"ArcReel versions 0.32.0 through 0.34.0 have a flaw in the /api/v1/providers/{id}/test endpoint that lets a remote requester make the server send requests to addresses it chooses (server-side request forgery). An attacker could use the server to reach internal services that are not exposed to the internet.","audience":"businesses","category":"other","nicknames":[],"who_cares":["arcreel","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server makes requests to internal addresses on attacker's behalf","analyst_note":"Confirm the fixed version and whether authentication is required for the endpoint; check the vendor advisory linked in the sources (github.com).","how_to_check":"- Check the installed ArcReel version and whether it is `0.32.0`, `0.33.0` or `0.34.0`\n- Check whether the `/api/v1/providers/{id}/test` endpoint is reachable from outside your network\n- unknown for any other check, since the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"ArcReel deployments on versions 0.32.0, 0.33.0 and 0.34.0 that expose the provider test-connection endpoint are affected; the sources do not say whether authentication is required. Teams running ArcReel on an internal network with the API not reachable from outside can rank this lower. unknown for anything beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4189,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121581':15A,18A '-2026':14A,17A '/0.33.0/0.34.0':82C '/api/v1/providers':34B,93C '/test':36B,95C '0.32.0':26B,81C '0.34.0':28B 'address':49B 'allow':7A 'arcreel':1A,19B,24B,80C 'attack':58B,117C 'choos':51B 'compon':98C 'connect':5A,102C 'contact':135C 'could':59B 'cve':13A,16A 'disclos':124C 'disclosur':139C 'earli':136C 'element':85C 'endpoint':6A,37B,103C 'exploit':114C,121C 'expos':70B 'file':92C 'flaw':31B 'forgeri':12A,56B,112C 'found':78C 'function':89C 'host':23B 'id':35B,94C 'impact':84C 'intern':65B 'internet':73B 'lead':106C 'let':39B 'make':43B 'manipul':105C 'may':129C 'possibl':119C 'provid':2A,99C 'public':127C 'reach':64B 'remot':41B,113C 'request':11A,42B,47B,55B,111C 'respond':143C 'self':22B 'self-host':21B 'send':46B 'server':9A,45B,53B,62B,109C 'server-sid':8A,52B,108C 'servic':66B 'side':10A,54B,110C 'test':4A,101C 'test-connect':3A,100C 'unknown':88C 'use':60B,131C 'vendor':133C 'version':25B 'vulner':75C 'way':146C","nicknames":[],"mitigations":[],"who_affected":"ArcReel deployments on versions 0.32.0, 0.33.0 and 0.34.0 that expose the provider test-connection endpoint are affected; the sources do not say whether authentication is required. Teams running ArcReel on an internal network with the API not reachable from outside can rank this lower. unknown for anything beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["arcreel","medium","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121581","severity":null,"published_at":"2026-11-03T23:17:35+00:00","modified_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null}],"documents":[{"id":61633,"url":"https://github.com/ArcReel/ArcReel/security/advisories/GHSA-hrr6-72vw-wgx5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}