---
id: "CVE-2026-121581"
kind: "vulnerability"
aliases: ["CVE-2026-121581"]
title: "ArcReel: provider test-connection endpoint allows server-side request forgery"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["arcreel", "other", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T23:17:35+00:00"
first_seen_at: "2026-11-03T23:45:14+00:00"
updated_at: "2026-11-03T23:45:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121581", "first_seen_at": "2026-11-03T23:45:14+00:00"}]
---

# ArcReel: provider test-connection endpoint allows server-side request forgery

ArcReel versions 0.32.0 through 0.34.0 have a flaw in the /api/v1/providers/{id}/test endpoint that lets a remote requester make the server send requests to addresses it chooses (server-side request forgery). An attacker could use the server to reach internal services that are not exposed to the internet.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ArcReel version and whether it is `0.32.0`, `0.33.0` or `0.34.0`
- Check whether the `/api/v1/providers/{id}/test` endpoint is reachable from outside your network

## Timeline

- 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121581

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ArcReel/ArcReel/security/advisories/GHSA-hrr6-72vw-wgx5

## From the sources

A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{id}/test of the component Provider Test-Connection Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_