VVVEB · CVE-2026-126379 · Package
NO FIX YET · SEE WHAT TO DO
Vvveb 1.0.8.6 has an incomplete server-side request forgery fix in the editor's oEmbed proxy. An authenticated admin can use a DNS-rebinding hostname with a non-443 port to read loopback services, internal panels and cloud metadata credentials.
first public Oct 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Vvveb 1.0.8.6 sites. An attacker needs an authenticated admin-panel session with editor access. They give the oEmbedProxy url parameter a hostname that rebinds to an internal IP, on a non-443 port or plain http, and read the response. What they can reach depends on the server: loopback services, internal admin panels and cloud metadata credentials. Sites with only trusted admins, or with no reachable internal services or metadata endpoint, are at lower risk.
Not affected if auth-required, no-internal-services-reachable, no-untrusted-admins
Who cares cms, self-hosted, vvveb
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
169.254.169.254 (use IMDSv2 with hop limit 1 on AWS)