CVE-2026-127093 · Other
NO FIX YET · SEE WHAT TO DO
Rustrak before 0.26.0 lets a user with integrations update permission send requests to any address through the integration test endpoint by supplying routing_override.url. An attacker can reach loopback, private-network and cloud metadata addresses and read non-2xx response bodies in the API reply.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Rustrak instances before 0.26.0 where some users hold the integrations update permission. Accounts without that permission cannot reach the test endpoint. Deployments on 0.26.0 or later are not affected.
Not affected if no-integrations-permission-users, version-0.26.0-or-later
Who cares rustrak, self-hosted
0.26.0 or later.Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.