CVE-2026-123201 · Package
NO FIX YET · SEE WHAT TO DO
Buku's bukuserver web interface lets an unauthenticated remote attacker make the server request internal hosts through the url parameter of /api/fetch_data or /api/network_handle. The attacker can read the page titles, descriptions and keywords of loopback, private and cloud metadata addresses.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run bukuserver, the web front end for the Buku bookmark manager, are exposed when it accepts requests from a network they do not control. The sources do not state a default configuration or whether authentication can be enabled. Installations that only run the buku command line tool on a single machine are not covered by this description.
Not affected if bukuserver-not-running, cli-only-use
Who cares buku, bukuserver, python, self-hosted
buku --version on the host where it is installed.5.1.1.Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.